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Preface 


This preface introduces the ARM” Cortex®-A73 MPCore Processor Technical Reference Manual. 


It contains the following: 


¢ About this book on page 9. 
e Feedback on page 13. 
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Preface 
About this book 


About this book 


This document gives reference documentation for the Cortex-A73 processor. It contains programming 
details for registers and describes the memory system, caches, debug trace, and interrupts. 


Product revision status 


The rmpn identifier indicates the revision status of the product described in this book, for example, r1p2, 
where: 

rm Identifies the major revision of the product, for example, r1. 

pn Identifies the minor revision or modification status of the product, for example, p2. 


Intended audience 


This book is written for system designers, system integrators, and programmers who are designing or 
programming a System-on-Chip (SoC) that uses the Cortex®-A73 processor. 


Using this book 
This book is organized into the following chapters: 


Chapter 1 Introduction 
This chapter introduces the Cortex-A73 processor and its features. 


Chapter 2 Functional Description 
This chapter describes the functionality of the Cortex-A73 processor. 


Chapter 3 Programmers Model 
This chapter describes the registers and provides information for programming the Cortex-A73 
processor. 


Chapter 4 System Control 
Describes the system registers, their structure, operation, and how to use them. 


Chapter 5 Memory Management Unit 
This chapter describes the Memory Management Unit (MMU). 


Chapter 6 Level 1 Memory System 
This chapter describes the Level 1 (L1) memory system. 


Chapter 7 Level 2 Memory System 
This chapter describes the Level 2 (L2) memory system. 


Chapter 8 Generic Interrupt Controller CPU Interface 
This chapter describes the Cortex-A73 processor implementation of the ARM Generic Interrupt 
Controller (GIC) CPU interface. 


Chapter 9 Generic Timer 
This chapter describes the Generic Timer for the Cortex-A73 processor. 


Chapter 10 Debug 
This chapter describes the Cortex-A73 processor debug registers and shows examples of how to 
use them. 


Chapter 11 Performance Monitor Unit 
This chapter describes the Performance Monitor Unit (PMU) and the registers that it uses. 


Chapter 12 Embedded Trace Macrocell 
This chapter describes the Embedded Trace Macrocell (ETM) for the Cortex-A73 processor. 


Chapter 13 Cross Trigger 
This chapter describes the cross trigger interface for the Cortex-A73 processor. 
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Chapter 14 Advanced SIMD and Floating-point Support 
This chapter describes the Advanced SIMD and floating-point features and registers in the 
Cortex-A73 processor. 


Appendix A Signal Descriptions 
This appendix describes the Cortex-A73 processor signals. 


Appendix B Revisions 
This appendix describes the technical changes between released issues of this document. 


Glossary 


The ARM Glossary is a list of terms used in ARM documentation, together with definitions for those 
terms. The ARM Glossary does not contain terms that are industry standard unless the ARM meaning 
differs from the generally accepted meaning. 


See the ARM Glossary for more information. 


Typographic conventions 
italic 
Introduces special terminology, denotes cross-references, and citations. 
bold 
Highlights interface elements, such as menu names. Denotes signal names. Also used for terms 
in descriptive lists, where appropriate. 
monospace 
Denotes text that you can enter at the keyboard, such as commands, file and program names, 
and source code. 
monospace 
Denotes a permitted abbreviation for a command or option. You can enter the underlined text 
instead of the full command or option name. 
monospace italic 
Denotes arguments to monospace text where the argument is to be replaced by a specific value. 
monospace bold 
Denotes language keywords when used outside example code. 


<and> 
Encloses replaceable terms for assembler syntax where they appear in code or code fragments. 
For example: 
MRC p15, ©, <Rd>, <CRn>, <CRm>, <Opcode_2> 
SMALL CAPITALS 


Used in body text for a few terms that have specific technical meanings, that are defined in the 
ARM glossary. For example, IMPLEMENTATION DEFINED, IMPLEMENTATION SPECIFIC, UNKNOWN, and 
UNPREDICTABLE. 


Timing diagrams 


The following figure explains the components used in timing diagrams. Variations, when they occur, 
have clear labels. You must not assume any timing information that is not explicit in the diagrams. 


Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded 
area at that time. The actual level is unimportant and does not affect normal operation. 
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Bus stable 


Bus to high impedance J 
Bus change X} 
High impedance to stable bus ~ ¥ 


Figure 1 Key to timing diagram conventions 


Signals 
The signal conventions are: 


Signal level 
The level of an asserted signal depends on whether the signal is active-HIGH or active-LOW. 
Asserted means: 
¢ HIGH for active-HIGH signals. 
e LOW for active-LOW signals. 


Lowercase n 
At the start or end of a signal name denotes an active-LOW signal. 


Additional reading 


This book contains information that is specific to this product. See the following documents for other 
relevant information. 


ARM publications 
e ARM” Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile (ARM DDI 
0487). 
¢ ARM” AMBA” AXI and ACE Protocol Specification AXI3, AXI4, and AXI4-Lite ACE and 
ACE-Lite (ARM IHI 0022). 


e+ ARM” AMBA” APB Protocol Specification (ARM IHI 0024). 

e ARM” AMBA” 4 ATB Protocol Specification ATBv1.0 and ATBv1.1 (ARM IHI 0032). 

¢ ARM” AMBA” 4 AXI4-Stream Protocol Specification (ARM IHI 0051). 

+ ARM” Low Power Interface Specification (ARM IHI 0068). 

+ ARM” CoreSight™ DAP-Lite Technical Reference Manual (ARM DDI 0316). 

e ARM” CoreSight™ SoC-400 Technical Reference Manual (ARM DDI 0480). 

+ ARM” Embedded Trace Macrocell Architecture Specification ETMv4 (ARM IHI 0064). 
e ARM” Generic Interrupt Controller Architecture Specification (ARM IHI 0069). 


The following confidential books are only available to licensees: 

+ ARM” Cortex®-A73 MPCore Processor Cryptographic Extension Technical Reference 
Manual (ARM 100049). 

e ARM” Cortex®-A73 MPCore Processor Configuration and Sign-off Guide (ARM 100050). 

+ ARM” Cortex®-A73 MPCore Processor Integration Manual (ARM 100051). 

+ ARM” Cortex®-A73 MPCore Processor Release Note. 
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Other publications 


This section lists relevant documents published by third parties: 
e ANSIAIEEE Std 754-2008, IEEE Standard for Binary Floating-Point Arithmetic. 


Note 


ARM floating-point terminology is largely based on the earlier ANSI/IEEE Std 754-1985 issue 
of the standard. See the ARM® Architecture Reference Manual ARMVv8, for ARMv8-A 
architecture profile for more information. 
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Feedback 


Feedback on this product 


If you have any comments or suggestions about this product, contact your supplier and give: 

e The product name. 

e The product revision or version. 

e An explanation with as much information as you can provide. Include symptoms and diagnostic 
procedures if appropriate. 


Feedback on content 


If you have comments on content then send an e-mail to errata@arm.com. Give: 


¢ The title ARM® Cortex®-A73 MPCore Processor Technical Reference Manual. 
e The number ARM 100048 0002_05 en. 

e Ifapplicable, the page number(s) to which your comments refer. 

e A concise explanation of your comments. 


ARM also welcomes general suggestions for additions and improvements. 
Note 


ARM tests the PDF only in Adobe Acrobat and Acrobat Reader, and cannot guarantee the quality of the 
represented document when used with any other PDF reader. 
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Chapter 1 
Introduction 


This chapter introduces the Cortex-A73 processor and its features. 


It contains the following sections: 


e 1.1 About the Cortex-A73 processor on page 1-15. 

e 1.2 Compliance on page 1-16. 

e 1.3 Features on page 1-18. 

e 1.4 Interfaces on page 1-19. 

e 1.5 Main Implementation options on page 1-20. 

e 1.6 Test features on page 1-21. 

¢ 1.7 Product documentation and design flow on page 1-22. 
e 1.8 Product revisions on page 1-24. 
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1.1 


About the Cortex-A73 processor 


1 Introduction 


1.1 About the Cortex-A73 processor 


The Cortex-A73 processor is a high-performance, low-power, ARM macrocell that implements the 
ARMv8-A architecture. 


It contains up to four cores, each with a Level 1 (L1) memory system and one shared Level 2 (L2) cache. 
The Cortex-A73 processor includes a superscalar, variable-length, out-of-order pipeline. Each core can 
handle a sustained maximum throughput of two instructions per cycle. 


The following figure shows an example of a configuration with four cores and an ACE interface. 
























































































































































Cortex-A73 processor 
A Timer events-————— Timer 
— Counter ACP* <——AX! slave interface=—»> 
——ICDT*, NIRQ, nFIQ== >| interrupt 
<4-ICCT*, nVCPUMNTIRQ =+ ne 
S—P MU Core 
Master ACE 
4 ATB Trace interface master interface > 
<4— Debug Debug 
Core 0 
Power 
Core 1* management e- Power contro |=}. 
Core 2* 
Core 3* 
<4—APB debugz=——— > 
Clocks;=—— > DFT m 
Resets————> Test 
MBI ST m 
Configuration => 
* Optional 


Figure 1-1 Example Cortex-A73 processor configuration 


See 2.7 About the Cortex-A73 processor functions on page 2-26 for more information about the 
functional components. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


1 Introduction 
1.2 Compliance 


1.2 Compliance 


The Cortex-A73 processor complies with, or implements, the specifications described in this section. 


This TRM complements architecture reference manuals, architecture specifications, protocol 
specifications, and relevant external standards. It does not duplicate information from these sources. 


This section contains the following subsections: 

e 1.2.1 ARM architecture on page 1-16. 

e 1.2.2 Interconnect architecture on page 1-16. 

e 1.2.3 Generic Interrupt Controller architecture on page 1-16. 
e 1.2.4 Generic Timer architecture on page 1-17. 

e 1.2.5 Debug architecture on page 1-17. 

¢ 1.2.6 Embedded Trace Macrocell architecture on page 1-17. 


1.2.1 ARM architecture 


The Cortex-A73 processor implements the ARMv8-A architecture with Advanced SIMD support and the 
optional ARMv8 Cryptographic Extension. 


The ARMv8-A architecture that is implemented in the Cortex-A73 processor includes: 


e Support for both AArch32 and AArch64 Execution states. 

e Support for all Exception levels, ELO, EL1, EL2, and EL3, in each execution state. 
e ARMv8 Debug architecture. 

e GICv4 interface. 

e AMBA 4 ACE bus architecture. 

e ETMv4 architecture (instruction trace only). 

e The A32 instruction set, previously called the ARM instruction set. 

e The T32 instruction set, previously called the Thumb instruction set. 

e The A64 instruction set. 


The Cortex-A73 processor supports the following features: 
e Floating-point and Advanced SIMD support for integer and floating-point vector operations. 
Note 


The Advanced SIMD architecture, its associated implementations, and supporting software, are also 
referred to as NEON technology. 








e Optional ARMv8 Cryptographic Extension. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


1.2.2 Interconnect architecture 
The Cortex-A73 bus interface natively supports the AMBA 4 ACE bus architecture. 


See the ARM® AMBA” AXI and ACE Protocol Specification AXI3, AXT4, and AXI4-Lite, ACE and ACE- 
Lite. 


1.2.3 Generic Interrupt Controller architecture 
The Cortex-A73 processor implements the Generic Interrupt Controller (GIC) v4 architecture. 


The Cortex-A73 processor includes only the GIC CPU Interface. See the ARM® Generic Interrupt 
Controller Architecture Specification, GICV4. 
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1.2.4 Generic Timer architecture 


The Cortex-A73 processor implements the ARM Generic Timer architecture with a 64-bit counter for 
each core. 


See the ARM® Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile. 


1.2.5 Debug architecture 
The Cortex-A73 processor implements the ARMv8 Debug architecture. 


The CoreSight™ Cross Trigger Interface (CTI) enables the debug logic, the Embedded Trace Macrocell 
(ETMV4), and the Performance Monitor Unit (PMU), to interact with each other and with other 
CoreSight components. 


For more information, see the following documents: 
+ ARM” CoreSight Architecture Specification. 
e+ ARM” Architecture Reference Manual ARMvé8, for ARMv8-A architecture profile. 


1.2.6 Embedded Trace Macrocell architecture 
The Cortex-A73 processor implements the ETMvV4 architecture for Program Trace only. 


See the ARM® ETM Architecture Specification, ETMv4. 
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1.3 Features 


The Cortex-A73 processor includes the following features: 


Full implementation of the ARMv8-A architecture instruction set with the architecture options listed 
in 7.2.1 ARM architecture on page 1-16. 

AArch64 and AArch32 support at all Exception levels (ELO to EL3). 

Superscalar, variable-length, out-of-order pipeline with symmetrical dual-issue of most instructions. 
Level 2 (L2) memory system providing cluster memory coherency and an L2 cache. 

An integrated Data Engine unit that executes floating-point and Advanced SIMD instruction sets. The 
Data Engine provides full IEEE 754-2008 support for SIMD pipelines. 

An optional ARMv8 Cryptographic accelerator engine for AES, SHA1, and SHA2-256. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
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1.4 Interfaces 
The Cortex-A73 processor has the following external interfaces: 


e Memory interface that implements an ACE interface. 

e Optional Accelerator Coherency Port (ACP) that implements an AXI slave interface. 
e Debug interface that implements an AMBA APB slave interface. 

e Trace interface that implements an AMBA ATB interface. 

e Cross Trigger Interface (CTI). 

¢ Design for Test (DFT). 

e Memory Built-In Self Test (MBIST). 

e Q-channel, for power management. 


See 2.2 Interfaces on page 2-31 for more information on each of these interfaces. 
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1 Introduction 
1.5 Main Implementation options 


The following table lists the main implementation options at build time for the Cortex-A73 processor. 


Table 1-1 Cortex-A73 processor implementation options 














Feature Range of options 
Number of cores 1-4 
L1 data cache size e 32KB 
* 64KB 
L2 cache size e 256KB 
e 512KB 
* 1024KB 
* 2048KB 
« 4096KB 
* 8192KB 





L2 ECC support 


Can be included or not included. 























L2 Tag RAM setup latency 0-7 
L2 Tag RAM read latency 0-7 
L2 Tag RAM write latency 0-7 
L2 Data RAM setup latency 0-7 
L2 Data RAM read latency 0-7 
L2 Data RAM write latency 0-7 





Cryptographic Extension 


Can be included or not included. 








Accelerator Coherency Port (ACP) 


Can be included or not included. 








Note 





e All the cores share a common L2 cache, and each core has the same configuration for all parameters. 
e Ifthe design is configured for one core, the ACE system level coherency support is retained. 





This section contains the following subsections: 


e 1.5.1 Processor configuration on page 1-20. 


1.5.1 Processor configuration 


All cores in a cluster have identical configurations, that were determined during the build configuration. 
These configurations cannot be changed by software. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 1-20 


reserved. 
Non-Confidential 


1 Introduction 
1.6 Test features 


1.6 Test features 


The Cortex-A73 processor provides test signals that enable the use of both DFT and MBIST interface 
signals to test the processor and its memory arrays. 


See A./ About the signal descriptions on page Appx-A-567 for more information. 
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1.7 Product documentation and design flow 


This section outlines the documentation available for the Cortex-A73 processor and when to use it in the 
design flow. 


See 7.7.7 Documentation on page 1-22 for a list of publications. For information on the relevant 
architectural standards and protocols, see /.2 Compliance on page 1-16. 


1.7.1 Documentation 


There are three specific documents describing the Cortex-A73 processor: Technical Reference Manual, 
Configuration and Sign-off Guide, and Integration Manual. 


The Cortex-A73 processor documentation is as follows: 


Technical Reference Manual 

The Technical Reference Manual (TRM) describes the functionality and the effects of functional 
options on the behavior of the Cortex-A73 processor. This information is required at all stages 
of the design flow. However, the choices that are made during the design flow can mean that 
some behavior described in the TRM is not relevant. If you are programming the Cortex-A73 
processor, then contact: 
¢ The implementer to determine: 

— The build configuration of the implementation. 

— What integration, if any, was performed before implementing the Cortex-A73 processor. 
¢ The integrator to determine the pin configuration of the device that you are using. 


There is a separate TRM for the optional Cryptographic Extension. 


Configuration and Sign-off Guide 
The Configuration and Sign-off Guide (CSG) describes: 
e The available build configuration options and related issues in selecting them. 
¢ How to configure the Register Transfer Level (RTL) source files with the build configuration 
options. 
e How to integrate RAM arrays. 
¢ How to run test vectors. 
¢ The processes to sign off the configured design. 


The ARM product deliverables include reference scripts and information about using them to 
implement your design. Reference methodology flows supplied by ARM are example reference 
implementations. Contact your EDA vendor for EDA tool support. 


The CSG is a confidential document that is only available to licensees. 


Integration Manual 
The Jntegration Manual (IM) describes how to integrate the Cortex-A73 processor into a SoC. It 
includes a description of the pins that the integrator must tie off to configure the processor. 
Some of the integration is affected by the configuration options that are used when 
implementing the Cortex-A73 processor. 


The IM is a confidential document that is only available to licensees. 


1.7.2 Design flow 


The Cortex-A73 processor is delivered as synthesizable RTL. Before it can be used in a product, it must 
go through the process described in this section. 


The process is divided into three stages: 


Implementation 
The implementer configures and synthesizes the RTL to produce a hard macrocell. This includes 
integrating RAMs into the processor. 
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Integration 
The integrator connects the macrocell into a SoC. This includes connecting it to a memory 
system and peripherals. 

Programming 
This is the last process. The system programmer develops the software required to configure and 
initialize the Cortex-A73 processor, and tests the required application software. 


Each process: 


e Can be performed by a different person or team. 
e Can include implementation and integration choices that affect the behavior and features of the 
Cortex-A73 processor. 


The operation of the final device depends on: 


Build configuration 
The implementer chooses the options that affect how the RTL source files are pre-processed. 
These options usually include or exclude logic that affects one or more of the area, maximum 
frequency, and features of the resulting macrocell. 

Configuration inputs 
The integrator configures some features of the Cortex-A73 processor by tying inputs to specific 
values. These configurations affect the start-up behavior before any software configuration is 
made. They can also limit the options available to the software. 

Software configuration 
The programmer configures the Cortex-A73 processor by programming particular values into 
registers. This affects the behavior of the processor. 


Note 


This manual refers to implementation-defined features that apply to build configuration options. 
Reference to a feature that is included means that the appropriate build and pin configuration options 
have been selected. Reference to an enabled feature means that the feature has also been configured by 
software. 
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1.8 Product revisions 


This section indicates the first release and, in subsequent releases, describes the differences in 
functionality between product revisions. 





r0p0 
First release. 
r0p1 
Q-channel interface now supports Wait for Event (WFE). 
r0p2 
Fixes most of the errata from r0p1. 
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Chapter 2 


Functional Description 


This chapter describes the functionality of the Cortex-A73 processor. 


It contains the following sections: 

e 2.1 About the Cortex-A73 processor functions on page 2-26. 
e 2.2 Interfaces on page 2-31. 

e 2.3 Clocking and resets on page 2-33. 

e 2.4 Power management on page 2-41. 
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2 Functional Description 
2.1 About the Cortex-A73 processor functions 


2.1 About the Cortex-A73 processor functions 


The following figure shows a top-level functional diagram of the Cortex-A73 processor. 
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Figure 2-1 Cortex-A73 processor block diagram 


This section contains the following subsections: 
e 2.1.1 Instruction side memory system on page 2-28. 
e 2.1.2 Integer core on page 2-28. 
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¢ 2.1.3 Data side memory system on page 2-28. 

e 2.1.4 Memory Management Unit on page 2-29. 

¢ 2.1.5 Advanced SIMD and Floating-point support on page 2-29. 
e 2.1.6 Cryptographic Extension on page 2-29. 

e 2.1.7 Level 2 memory system on page 2-29. 

¢ 2.1.8 Performance monitoring on page 2-30. 

e 2.1.9 Debug and trace on page 2-30. 


2.1.1 Instruction side memory system 


The Jnstruction side (1-side) fetches instructions from the Level 2 (L2) cache, stores them in a 4-way 
Level 1 (L1) cache, and feeds up to two instructions at the same time to a core. 


The Cortex-A73 I-side performs static and dynamic branch prediction. Dynamic prediction uses a two- 
level global history buffer and a branch target address cache. A nested return stack speeds up function 
returns. 


The instruction cache is indexed by virtual address, and the tag is matched with the physical address. The 
physical address is generated by the Instruction micro TLB. 


The I-side can issue up to four 64-byte wide requests to L2 memory. The preload hint instruction, PLI, is 
supported and only performs L2 cache preloading. 


The instruction cache is part of the L1 Memory system. 
See Chapter 6 Level 1 Memory System on page 6-327 for more information. 


The I-side performs the following dynamic branch predictions, using Branch Target Address Cache 
(BTAC). It predicts: 

e Whether the branch is likely to be taken, or not. 

e The target of the branch, if it is taken. 

¢ The target state (A32/T32). 

e The type of the branch that is taken. 


2.1.2 Integer core 


The integer core holds most of the program-visible state of the processor, such as general-purpose 
registers and system registers. 


The integer core provides configuration and control of the memory system and its associated 
functionality. It decodes and executes instructions, operating on data held in the registers in accordance 
with the ARMv8-A architecture. Instructions are fed to the integer core from the /nstruction side memory 
system (I-side). The integer core executes instructions that require data to be transferred to or from the 
memory system by interfacing to the Data side memory system (D-side), that manages all load and store 
operations. 


See Chapter 3 Programmers Model on page 3-53 and Chapter 4 System Control on page 4-64 for 
more information. 


2.1.3 Data side memory system 


The Data side memory system (D-side) handles load and store requests from the Load Store Unit (LSU). 
It uses memory attributes from the MMU to determine the type of access required, and whether 
permission to access a memory region is granted. 


Data side memory system (D-side) includes: 

e A prefetcher, which detects regular patterns of loads or stores, and prefetches cache lines. 

« A Store Buffer (STB), which holds committed store operations that have not yet been allocated in the 
L1 data cache, or that have been directly sent to the L2 when a stream of full cache line writes that 
misses in the L1 cache is detected. The STB can merge several store operations into a single 
transaction if they are sent to the same 64-bit aligned address. 





ARM 100048 0002 _05_ en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 2-28 
reserved. 
Non-Confidential 


2 Functional Description 
2.1 About the Cortex-A73 processor functions 


¢ A Bus Interface Unit (BIU), which can send up to 8 concurrent cacheable linefill requests to the L2 
memory system. 

¢ A Virtually Indexed Physically Tagged (VIPT) Level-1 (L1) data cache, which behaves as either an 
eight-way set associative cache (for 32KB configurations) or a 16-way set associative PIPT cache 
(for 64KB configurations). 

e A 48-entry fully-associative L1 Data TLBs. 

e An LI data cache auto-prefetching buffer supporting up to eight streams. 


2.1.4 Memory Management Unit 


The processor includes a Memory Management Unit (MMU) to enable virtual addresses to be translated 
to physical addresses. 


The MMU uses a set of translation tables that map a virtual address to a physical address. The translation 
table entries also hold memory attributes and access permissions. The MMU uses the attributes and 
permissions to allow or prevent the processor from accessing memory regions. The MMU autonomously 
accesses memory to read the translation tables. This is referred to as a translation table walk. 


The results of a translation table walk are cached in Translation Lookaside Buffers (TLBs). The Cortex- 
A73 processor has three TLBs: 


e A main, unified, TLB that holds translations for both instruction and data accesses (L2 TLB). 
¢ An instruction micro TLB that holds translations for instruction accesses (L1 instruction TLB). 
e A data micro TLB that holds translations for data accesses (L1 data TLB). 


Both micro TLBs are implemented to give single-cycle access to translation results. 


For more information, see Chapter 5 Memory Management Unit on page 5-320. 


2.1.5 Advanced SIMD and Floating-point support 


Advanced SIMD and floating-point technology are media and signal processing architectures that add 
instructions targeted at audio, video, 3-D graphics, image, and speech processing. Advanced SIMD 
instructions are available in AArch64 and AArch32 states. 


The floating-point architecture includes the floating-point register file and status registers. It performs 
floating-point operations on the data held in the floating-point register file. 


See Chapter 14 Advanced SIMD and Floating-point Support on page 14-543 for more information. 


2.1.6 Cryptographic Extension 


The optional Cortex-A73 MPCore Cryptographic Extension supports the ARMv8 Cryptographic 
Extensions. 


The Cryptographic Extension adds new A64, A32, and T32 instructions to Advanced SIMD that 
accelerate Advanced Encryption Standard (AES) and other encryption and decryption algorithms. 


See the ARM® Cortex®-A73 MPCore Processor Cryptographic Extension Technical Reference Manual 
for more information. 


2.1.7 Level 2 memory system 


The Cortex-A73 Level 2 (L2) memory system contains the L2 cache pipeline and all logic that is 
required to maintain memory coherence between the cores of the cluster. 


The Cortex-A73 L2 memory system has the following features: 


e An L2 cache that: 
— Has a cache RAM size of 256KB, 512KB, 1MB, 2MB, 4MB or 8MB. 
— Is 16-way set associative with optional tag and data Error Correction Code (ECC) protection per 
64 bits. 
— Supports 64-byte cache lines. 
e A 512-bit wide fetch path from the L2 cache. 
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e Two 128-bit slave interfaces per core for instruction fetches and data fetches. 
e A single 128-bit wide master interface to external memory that: 
— Implements the AMBA 4 ACE architecture. 
— Supports a 40-bit physical address range. 
e An optional 128-bit wide I/O coherent ACP interface that can allocate to the L2 cache. 


An integrated Snoop Control Unit (SCU) connects the cores to the L2 memory system. The SCU 
maintains data cache coherency between the cores and between the ACP port and cores, as well as 
arbitrates L2 requests from the cores. 


When the Cortex-A73 processor is implemented with a single core, it still includes the SCU. 
Note 


The SCU supports hardware management of coherency of the instruction cache requests. Instruction 
cache linefills perform coherent reads. There is no coherency management of data held in the instruction 
cache. 








See Chapter 7 Level 2 Memory System on page 7-349 for more information. 


2.1.8 Performance monitoring 


The Cortex-A73 processor provides performance counters and event monitors that can be configured to 
gather statistics on the operation of the processor and the memory system. 


See Chapter 11 Performance Monitor Unit on page 11-425 for more information. 


2.1.9 Debug and trace 
The Cortex-A73 processor provides extensive support for real-time debug and performance profiling. 


The Cortex-A73 processor supports a range of debug and trace features including: 
e ARM-V8 debug features in each core. 

e ETMv4 instruction trace unit for Program Trace only, for each core. 

e CoreSight Cross Trigger Interface (CTI). 

e CoreSight Cross Trigger Matrix (CTM). 

e Debug ROM. 


The Cortex-A73 processor has an Advanced Peripheral Bus version 3 (APBv3) debug interface that is 
CoreSight compliant. This permits system access to debug resources, for example, the setting of 
watchpoints and breakpoints. 


The Cortex-A73 processor provides performance monitors that can be configured to gather statistics on 
the operation of each core and the memory system. The performance monitors implement the ARM 
PMUv3 architecture. 


See Chapter 10 Debug on page 10-377, Chapter 11 Performance Monitor Unit on page 11-425, and 
Chapter 12 Embedded Trace Macrocell on page 12-463 for more information. 
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2.2 Interfaces 
This section describes the external interfaces of the Cortex-A73 processor. 


This section contains the following subsections: 

¢ 2.2.1 Master memory interface on page 2-31. 

e 2.2.2 Accelerator Coherency Port on page 2-31. 

e 2.2.3 External debug interface on page 2-31. 

e 2.2.4 Trace interface on page 2-31. 

e 2.2.5 Cross Trigger Interface on page 2-32. 

e 2.2.6 Design For Test interface on page 2-32. 

e 2.2.7 Memory Built-In Self Test interface on page 2-32. 
e 2.2.8 Q-channel interface on page 2-32. 


2.2.1 Master memory interface 


The Cortex-A73 processor implements the AMBA 4 ACE interface. 


ACE is an extension to the AXI protocol and provides the following enhancements: 


e Support for hardware cache coherency. 
e Barrier transactions that guarantee transaction ordering. 
e Distributed virtual memory messaging, enabling management of a virtual memory system. 


See the ARM® AMBA® AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, ACE and 
ACE-Lite for more information. 
2.2.2 Accelerator Coherency Port 


The processor supports an Accelerator Coherency Port (ACP). The ACP reduces software cache 
maintenance operations when sharing memory regions with other masters, and allows other masters to 
allocate data into the L2 cache. 


The ACP is an AMBA 4 slave interface. 


The ACP slave interface allows an external master to make coherent requests to shared memory, but it 
does not support cache maintenance, coherency, barrier, or DVM transactions. 


See 7.6 ACP on page 7-358 and the ARM” AMBA” AXI and ACE Protocol Specification AXI3, AXI4, and 
AXT4-Lite, ACE and ACE-Lite for more information. 
2.2.3 External debug interface 


The Cortex-A73 processor supports an AMBA 3 APB v1.0 interface that enables access to the debug 
registers. 


The ARMv8-A debug includes watchpoint and breakpoint support as well as the APB slave interface to a 
CoreSight debug system. 


This also includes CoreSight Cross Trigger Interface (CTI) and Cross Trigger Matrix (CTM) modules 
for multi-core debugging. 


See the ARM® CoreSight Architecture Specification for more information. 


2.2.4 Trace interface 


The processor supports dedicated AMBA 4 ATB interfaces for each core that outputs trace information 
for debugging. 


The ATB interface is compatible with the CoreSight architecture. See the ARM® AMBA” 4 ATB Protocol 
Specification for more information. 





ARM 100048 0002 _05_ en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 2-31 
reserved. 
Non-Confidential 


2.2.5 


2.2.6 


2.2.7 


2.2.8 


2 Functional Description 
2.2 Interfaces 


Cross Trigger Interface 
The Cortex-A73 processor implements a single cross trigger channel interface. 


This external interface is connected to the CoreSight Cross Trigger Interface (CTI) corresponding to 
each core through a simplified Cross Trigger Matrix (CTM). See Chapter 13 Cross Trigger 
on page 13-526 for more information. 


Design For Test interface 


The processor implements a Design For Test (DFT) interface that enables an industry standard Automatic 
Test Pattern Generation (ATPG) tool to test logic outside of the embedded memories. 


See 4.16.1 DFT interface on page Appx-A-594 for information on these test signals. 


Memory Built-In Self Test interface 


The Memory Built-In Self Test (MBIST) controller interface provides support for manufacturing tests of 
the memories embedded in the Cortex-A73 processor. 


See Appendix A Signal Descriptions on page Appx-A-566 for information on this interface. 


Q-channel interface 


The Q-channel interfaces enable communication to an external power controller to support dynamic 
retention of the cores and the L2 cache RAM. 


See 2.4 Power management on page 2-41. 
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2.3 Clocking and resets 
The following sections describe clocking and resets: 


e 2.3.1 Clocks on page 2-33. 
e 2.3.2 Input synchronization on page 2-36. 
e 2.3.3 Resets on page 2-37. 


2.3.1 Clocks 
The Cortex-A73 processor has a single clock input, CLK. 


All cores in the Cortex-A73 processor, SCU, top units and L2 control are clocked with a distributed 
version of CLK. 


The Cortex-A73 processor has the following clock enable signals: 

e PCLKENDBG see PCLKENDBG clock enable signal on page 2-33. 

e ACLKENM see ACLKENM clock enable signal on page 2-33. 

e ACLKENS see ACLKENS clock enable signal on page 2-34. 

e ATCLKEN see ATCLKEN clock enable signal on page 2-35. 

e CNTCLKEN see CNTCLKEN clock enable signal on page 2-35. 

e CORECLKEN[CN:0] see CORECLKEN/[CN:0] clock enable signal on page 2-36. 


PCLKENDBG clock enable signal 


The processor includes an APB interface to access the debug and performance monitoring registers. 


Internally this interface is driven from CLK. A separate enable signal, PCLKENDBG, is provided to 
enable the external APB bus to be driven at a lower frequency, that must be an integer ratio of CLK. If 
the debug infrastructure in the system is required to be fully asynchronous to the processor clock, you 
can use a synchronizing component to connect the external AMBA APB to the processor. 


The following figure shows a timing example of PCLKENDBG and PCLK, representing an internal 
clock signal, that changes the CLK to PCLK frequency ratio from 3:1 to 1:1. 
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Figure 2-2 PCLKENDBG with CLK:PCLK ratio changing from 3:1 to 1:1 
Note 





The previous figure shows the timing relationship between the APB master clock, PCLK and 
PCLKENDBG, where PCLKENDBG asserts two clock cycles before the rising edge of PCLK. It is 
important that this relationship between PCLK and PCLKENDBG is maintained. 





ACLKENM clock enable signal 


The master interface supports integer ratios of the CLK frequency, for example 1:1, 2:1, 3:1. 
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These ratios are configured through the ACLKENM signal. In all cases AXI transfers remain 
synchronous. 


ACLKEMNM asserts two CLK cycles before the rising edge of the external ACE clock signal, ACLKM. 
If you change the CLK to ACLKM frequency ratio, you must change ACLKENM correspondingly. 


The following figure shows a timing example of ACLKENM that changes the CLK to ACLKM 
frequency ratio from 3:1 to 1:1. 
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Figure 2-3 ACLKENM with CLK:ACLKM ratio changing from 3:1 to 1:1 
Note 





If there are any physical effects that could occur while changing the clock frequency, ARM recommends 
that the clock ratio is changed only while the STANDBYWFIL2 output of the processor is asserted. 





ACLKENS clock enable signal 
This signal is present only if the slave interface is configured to use the ACP protocol. 


The slave interface supports integer ratios of the CLK frequency, for example 1:1, 2:1, 3:1. These ratios 
are configured through the ACLKENS signal. In all cases AXI transfers remain synchronous. 


ACLKENS asserts two CLK cycles before the rising edge of the external ACP clock signal, ACLKS. If 
you change the CLK to ACLKS frequency ratio, you must change ACLKENS correspondingly. 


The following figure shows a timing example of ACLKENS that changes the CLK to ACLKS 
frequency ratio from 3:1 to 1:1. 
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Figure 2-4 ACLKENS with CLK:ACLKS ratio changing from 3:1 to 1:1 
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Note 


If there are any physical effects that could occur while changing the clock frequency, ARM recommends 
that the clock ratio is changed only while the STANDBYWFIL2 output of the processor is asserted. 








ATCLKEN clock enable signal 


The ATCLKEN signal enables the ATB synchronous interface to operate at any integer multiple that is 
equal to or slower than the main processor clock, CLK. 


For example, the CLK to ATCLK frequency ratio can be 1:1, 2:1, or 3:1, where ATCLK is the ATB bus 
clock. ATCLKEN asserts two CLK cycles before the rising edge of ATCLK. If you change the CLK to 
ATCLK frequency ratio, you must change ATCLKEN correspondingly. 


The following figure shows a timing example of ATCLKEN that changes the CLK to ATCLK 
frequency ratio from 3:1 to 1:1. 
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Figure 2-5 ATCLKEN with CLK:ATCLK ratio changing from 3:1 to 1:1 


CNTCLKEN clock enable signal 
The CNT VALUEB is a synchronous 64-bit binary encoded counter value that can operate at any integer 
multiple that is equal to or slower than the main processor clock, CLK, using the CNTCLKEN signal. 


Note 


CNTCLKEN is synchronous with CLK, and can be set at any cycle to follow the system clock, which is 
typically in the range 10 to 50 MHz. 








For example, you can set the CLK to CNTCLK frequency ratio to 1:1, 2:1, or 3:1, where CNTCLK is 
the system counter clock. CNTCLKEN asserts two CLK cycles prior to the rising edge of CNTCLK. 


The following figure shows a timing example of CNTCLKEN that changes the CLK to CNTCLK 
frequency ratio from 3:1 to 1:1. 
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Figure 2-6 CNTCLKEN with CLK:CNTCLK ratio changing from 3:1 to 1:1 


CORECLKEN[CN:0] clock enable signal 


The CORECLKEN[CN:9] is used with the global core clock, CLK to generate the internal CPU CORE 
level clock for each CPU domain. 


The following figure shows the timing of CORECLKEN[CN:0] that changes the CLK frequency to 
CPU CORE level clock frequency at a ratio of 4:1. 
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CORECLKEN[CN:0] asserts two CLK cycles 
before the rising edge of CPU CORE level 
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Figure 2-7 CORECLKEN[CN:0] with CLK:CPU CORE level clock 
In this example, the CLK to CORECLKEN[CN:0] frequency ratio is 4:1 that enables four CLK cycles 
for each CORECLKEN[CN:0] cycle. 
Note 
The CLK to CORECLKEN[CN:0] frequency ratio must not exceed 5:1. 








2.3.2 Input synchronization 
The Cortex-A73 processor synchronizes the following input signals: 


* CPUQREQn{3:0]. 

© L2QREQn. 

© nIRQ/3:0]. 

*  nFIQ[3:0]. 

* nVIRQ[3:0]. 

*  nVFIQ(3:0]. 

e CTICHIN[3:0]. 

e CTICHOUTACK]3:0]. 
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The SoC can present these inputs asynchronously. All other external signals must be synchronous with 
reference to CLK. 


Note 





The synchronized versions of the CTICHIN and CTICHOUTACK input signals are only used if the 
CISBYPASS input signal is deasserted LOW. If the CISBYPASS signal is asserted HIGH the 
CTICHIN and CTICHOUTACK synchronizers are not used, and the SoC must present the CTICHIN 
and CTICHOUTACK balanced with respect to CLK. 





2.3.3 Resets 


The following table shows the reset signals and their connection information: 


Table 2-1 Reset signals 









































Signal Direction Description Connection information 
nCORERESET[CN:0] Input Individual core resets not Connect to reset control logic. 
including Debug or ETM trace 
unit. 
nCPUPORESET[CN:0] Input Individual core powerup resets 
including both Debug and ETM 
trace unit. 
nPRESETDBG Input APB reset. 
nL2RESET Input L2 memory system reset. 
nMBISTRESET Input MBIST reset. 
L2RSTDISABLE Input Disable automatic L2 cache Drive this signal HIGH to 
invalidate at reset. disable L2 cache invalidate at 
This pin is sampled during reset reset, 
of the processor. Drive this signal LOW to 
enable L2 cache invalidate at 
reset. 
This signal must only be 
changed when the processor is 
in the reset state. 
WARMRSTREQ[CN:0] Output Processor Warm reset request. | Connect to reset control logic. 
DBGRSTREQ[CN:0] Output Debug Warm reset request. Connect to reset control logic. 
DBGLIRSTDISABLE Input Disable automatic L1 cache Drive this signal LOW for 


invalidate at reset. 


This pin is sampled during reset 
of the processor. 





normal L1 data cache behavior 
on reset. 


Drive this signal HIGH to 
disable automatic invalidation 
of L1 data cache on reset for 
debugging purposes only. 


This signal must be driven 
LOW during normal processor 
powerup sequences. 








The Cortex-A73 processor has the following active-LOW reset input signals: 
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nCORERESET[CN:0] 
Where CN is the number of cores minus one. 
These signals initialize all resettable registers in the processor, excluding debug registers, 
breakpoint logic, watchpoint logic, and ETM trace unit registers. 

nCPUPORESET[CN:0] 
Where CN is the number of cores minus one. 
These signals initialize all resettable registers in the processor, including debug registers, 
breakpoint logic, watchpoint logic, and ETM trace unit registers. 

nPRESETDBG 
This single, cluster-wide signal initializes the shared APB, PMU, ETM trace unit, debug 
registers, CTI, and CTM. 

nL2RESET 
This single, cluster-wide signal initializes all resettable registers in the L2 memory system, top- 
level logic, and the SCU logic. 

nMBISTRESET 
An external MBIST controller can use this signal to reset the entire design. The 
nMBISTRESET signal resets all resettable registers in the processor, for entry and exit from 
MBIST mode. It has priority over all other resets. 


All these resets can be asynchronously: 


e Asserted, HIGH to LOW. 
e Deasserted, LOW to HIGH. 


Reset synchronization logic inside the Cortex-A73 processor ensures that reset deassertion is 
synchronous for all resettable registers. The processor clock is not required for reset assertion, but the 
processor clock must be present for reset deassertion to ensure reset synchronization. 


Note 


You have to only hold reset signals active for eight processor clock cycles for the reset to take effect. 








The following table shows the valid reset combinations: 


Table 2-2 Valid reset combinations 





Reset combination Signals Value | Description 





Processor Cold reset nCPUPORESET/[CN:9] | all = 0° | All logic is held in reset. 


nCORERESET[CN:0] | all = X? 


nPRESETDBG 0 
nL2RESET 0 
nMBISTRESET 1 





Processor Cold reset with debug | nCPUPORESET[CN:90] | all=0° | All cores are held in reset so they can be powered up. The L2 





nCORERESET|CN:0] | all =X? is held in reset, but must remain powered up. This enables 
` external debug over power down for the processor. 




















nPRESETDBG 1 
nL2RESET 0 
nMBISTRESET 1 
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Table 2-2 Valid reset combinations (continued) 





Reset combination 


Signals 


Description 





Individual core Cold reset with 
debug active 


nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 


for the core that is held in reset. 


Individual core is held in reset, so that the core can be 
powered up. This enables external debug over power down 





Individual core Warm reset with 
trace and debug active 


nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 


Individual core is held in reset. 





Debug logic reset 


nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 


Processor debug logic is held in reset. 





MBIST reset 


nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 


All logic is held in reset. 





Normal state 








nCPUPORESET[CN:0] 
nCORERESET[CN:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 


No logic is held in reset. 














Reset sequence with reset repeaters 


The reset repeater provides an asynchronously asserted, synchronously deasserted reset signal to internal 


registers. 


When reset repeaters are present, CLK must be asserted while nRESET is asserted. However, there is 
no need to stop the CLK when nRESET is deasserted. 


Reset sequence without reset repeaters 

When there is no reset repeater, the following steps must be taken: 
1. CLK must be asserted while nRESET is asserted LOW. 

2. CLK must be turned off. 





a ~ For Cold reset hCPUPORESET must be asserted. hCORERESET can be asserted but is not required. 
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3. nRESET is deasserted. 
4. CLK can be reasserted as explained in the following diagram. 





CLK | 


nRESET = Ñ 





























ET ESF] 
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Wait until reset deassertion is propagated 
through the whole design 


Figure 2-8 Reset sequence without reset repeaters 
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2.4 Power management 


The Cortex-A73 processor provides mechanisms and support to control both dynamic and static power 
dissipation. 

This section contains the following subsections: 

e 2.4.1 Power domains on page 2-41. 

e 2.4.2 Dynamic Power Management on page 2-41. 

e 2.4.3 Power modes on page 2-48. 


2.4.1 Power domains 


The Cortex-A73 processor can support multiple power domains. Each power domain has four possible 
States. 


The Cortex-A73 processor supports the following power domains: 


¢ The top-level domain (PDARTEMIS) including: 
— SCU logic and its tag RAM. 
— BIST multiplexors and clock modules. 
— Various interface modules. 
— L2 logic. 
— Debug. 
e Core 0-3 domain (PDCPU<n>), including RAMs. 
e The L2 data, tag, and cache replacement RAM domain (PDL2RAM). 


The figure below shows an example of the organization of the power domains. 


Core RAM Core RAM Core RAM Core RAM 


L2 data RAM 

















L2 tag RAM 





L2 cache replacement RAM 














Figure 2-9 Cortex-A73 processor power domain diagram 


The Cortex-A73 power domains have the following features: 


e Each power domain has a separate controllable clock. 
¢ Except for RAM-related domains, each power domain has a separate controllable reset. 
« Each power domain has its own level of hierarchy. 


2.4.2 Dynamic Power Management 
This section describes the following dynamic power management features in the processor: 


e Normal state on page 2-42. 
e Standby state on page 2-42. 
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e Core Wait for Interrupt on page 2-42. 

e Core Wait for Event on page 2-43. 

e Event communication using WFE or SEV on page 2-43. 

e CLREXMON request and acknowledge signaling on page 2-44. 
e L2 Wait for Interrupt on page 2-44. 

e L2 hardware cache flush on page 2-44. 

e Core dynamic retention on page 2-45. 

e L2 RAMs dynamic retention on page 2-47. 


The processor exits standby mode when interrupts or external events occur. 
See Event communication using WFE or SEV on page 2-43 for more information. 


You must only use dynamic power management sequences described in the sections listed above. Any 
deviation from these sequences can lead to UNPREDICTABLE results. 


Normal state 


This is the normal mode of operation where all of the processor functionality is available. The Cortex- 
A73 processor uses gated clocks and gates to disable inputs to unused functional blocks. Only the logic 
in use to perform an operation consumes dynamic power. 


Standby state 


When a power domain receives a signal to enter standby state, the domain waits for transactions to 
complete before entering into standby state. 


The following sections describe the methods of entering standby state: 
e Core Wait for Interrupt on page 2-42. 

e Core Wait for Event on page 2-43. 

e L2 Wait for Interrupt on page 2-44. 


Core Wait for Interrupt 


Wait for Interrupt (WFYI) is a feature of the ARMv8-A architecture that puts the core in a standby state by 
disabling most of the clocks in the core while keeping the core powered up. 


This reduces the power that is drawn to static leakage current only, except for a small dynamic power 
overhead on the logic to enable the core to wake up from WFI standby state. 


Software indicates that the core can enter the WFI standby state by executing the WFI instruction. 


When the core is executing the WFI instruction, the core waits for all instructions in the core to retire 
before entering the standby state. The WFI instruction ensures that all explicit memory accesses, that 
occurred before the WFI instruction in program order, have retired. For example, the WFI instruction 

ensures that the following instructions received the required data or responses from the L2 memory 

system: 


¢ Load instructions. 
e Cache and TLB maintenance operations. 
¢ Store exclusive instructions. 


In addition, the WFI instruction ensures that store instructions have updated the cache or have been issued 
to the SCU. 


While the core is in WFI standby state, the clocks in the core are temporarily enabled without causing the 
core to exit WFI standby state, when any of the following events are detected: 


e A snoop request that must be serviced by the core L1 Data cache. 

e A cache or TLB maintenance operation that must be serviced by the core L1 Instruction cache, data 
cache, or TLB. 

e An APB access to the debug or trace registers residing in the core power domain. 
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Exit from WFI standby state occurs when the core detects a reset or one of the WFI wake-up events as 
described in the ARM® Architecture Reference Manual ARMV8, for ARMV8-A architecture profile. 


On entry into WFI standby state, STANDBYWFI[CN:0] for that core is asserted. Assertion of 
STANDBYWFI[CN:0] guarantees that the core is in a standby state. STANDBYWFI[CN:0] continues 
to assert even if the clocks in the core are temporarily enabled because of an L2 snoop request, cache, or 
TLB maintenance operation or an APB access. 

Note 
STANDBYWFI[CN:0] does not indicate completion of L2 memory system transactions that are 
initiated by the processor. All Cortex-A73 processor implementations contain an L2 memory system. 








Core Wait for Event 


Wait for Event (WFE) is a feature of the ARMv8-A architecture that can be used by a locking mechanism 
that is based on events to put the core in a standby state by disabling most of the clocks in the core while 
keeping the core powered up. 


This reduces the power that is drawn to static leakage current only, except for a small dynamic power 
overhead on the logic to enable the core to wake up from WFE standby state. 


A core enters into WFE standby state by executing the WFE instruction. When executing the WFE 
instruction, the core waits for all instructions in the core to complete before entering the standby state. 


If the event register is set, execution of WFE does not cause entry into standby state, but clears the event 
register. 


While the core is in WFE standby state, the clocks in the core are temporarily enabled without causing 

the core to exit WFE standby state when any of the following events are detected: 

e A snoop request that must be serviced by the core L1 Data cache. 

e A cache or TLB maintenance operation that must be serviced by the core L1 Instruction cache, data 
cache, or TLB. 

e An APB access to the debug or trace registers residing in the core power domain. 


A core exits WFE standby state when the core detects a reset, the assertion of the EVENTI input signal, 
or one of the WFE wake-up events as described in the ARM® Architecture Reference Manual ARMvé, for 
ARMVv8-A architecture profile. 


When a core enters WFE standby state, the STANDBYWFE[CN:0] signal for that core is asserted. 
Assertion of STANDBYWFE[CN:0] guarantees that the core is in a standby state. 
STANDBYWFE[CN:0] continues to assert even if the clocks in the core are temporarily enabled 
because of an L2 snoop request, cache, and TLB maintenance operation or an APB access. 


Event communication using WFE or SEV 


An external agent can use the EVENTI pin to participate in a WFE or SEV event communication with 
the Cortex-A73 processor. 


When this pin is asserted, it sends an event message to all the cores in the device. This is similar to 
executing a SEV instruction on one core in the cluster. This enables the external agent to signal to the 
cores that it has released a semaphore and that the cores can leave the WFE standby state. The EVENTI 
input pin must remain HIGH for at least one CLK clock cycle to be visible by the cores. 


The external agent can determine that at least one of the cores in the cluster has executed an SEV 
instruction by checking the EVENTO pin. When SEV is executed by any of the cores in the cluster, an 
event is signaled to all the cores in the device, and the EVENTO pin is asserted. This pin is asserted 
HIGH for one CLK clock cycle when any core in the cluster executes an SEV instruction. 
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CLREXMON request and acknowledge signaling 


When the CLREXMONREQ input is asserted, it signals the clearing of an external global exclusive 
monitor and acts as a WFE wake-up event to all the cores in the cluster. 


The CLREXMONREQ signal has a corresponding CLREXMONACK response signal. This forms a 
standard 2-wire, 4-phase handshake that can be used to signal across the voltage and frequency boundary 
between the core and system. 


The following figure shows the CLREXMON request and acknowledge handshake. When the request 
signal is asserted, it continues to assert until an acknowledge is received. When the request is deasserted, 


the acknowledge can then deassert. 
CLREXMONREQ 
CLREXMONACK 


Figure 2-10 CLREXMON request and acknowledge handshake 





L2 Wait for Interrupt 


When all the cores are in WFI standby state, the shared L2 memory system logic that is common to all 
the cores can also enter a WFI standby state. 


Entry into L2 WFI standby state can occur only if specific requirements are met and the following 
sequence applied: 


e All cores are in WFI standby state and therefore, the STANDBYWFI output for each core is asserted. 
Assertion of all the core STANDBYWFI outputs guarantees that all the cores are in standby state. 

e The SoC asserts the input pin ACINACTM to idle the AXI master interface. This indicates that no 
snoop requests will be made from the external memory system. 

e Ifconfigured with an ACP interface, the SoC asserts the AINACTS input pin to idle the ACP 
interface. This indicates that the SoC will no longer send transactions on the ACP interface. 


When the L2 memory system completes the outstanding transactions for the AXI interface, it can then 
enter the L2 WFI standby state. On entry into L2 WFI standby state, STANDBYWFIL2 is asserted. 
Assertion of STANDBYWFIL2 guarantees that the L2 memory system is idle and will not accept new 
transactions. 


Exit from L2 WFI standby state occurs on one of the following events: 
e AINACTS or ACINACTM is deasserted. 
e A processor exits a standby state (STANDBYWFI LOW). 


When a core exits from WFI standby state, STANDBYWFI for that core is deasserted. When the L2 
memory system logic exits from WFI standby state, STANDBY WFIL2 is deasserted. 


L2 hardware cache flush 


The processor provides an efficient way to fully clean and invalidate the L2 cache in preparation for 
powering it down without requiring the waking of a core to perform the clean and invalidate through 
software. 


Use of L2 hardware cache flush can only occur if specific requirements are met and the following 

sequence applied: 

1. All cores are in the WFI low-power state, so all the core STANDBYWFI outputs are asserted. 

2. When ACP is present and all outstanding ACP transactions are complete, the SoC asserts the 

AINACTS signal to idle the ACP. This is necessary to prevent ACP transactions from allocating new 

entries in the L2 cache while the hardware cache flush is occurring. When AINACTS has been 

asserted, the SoC must not assert ARVALIDS, AWVALIDS, or WVALIDS. 

The SoC can now assert the LAFLUSHREQ input. 

4. The L2 performs a series of internal clean and invalidate operations to each set and way of the L2 
cache. Any dirty cache lines are written back to the system using WriteBack operations. Clean cache 
lines can cause Evict transactions if the L2 is configured to perform these actions. 


Ww 
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5. When the L2 completes the clean and invalidate sequence, it asserts the LAFLUSHDONE signal. 
The SoC can now deassert L2FLUSHREQ signal and then the L2 deasserts LAFLUSHDONE. 

6. When all outstanding snoop transactions are completed, the SoC can assert the ACINACTM signal. 
In response, the L2 asserts the STANDBYWFIL2 signal. 


The following figure shows the L2 hardware cache flush timing. 





CLK | | 


STANDBYWFI[CN:0] a ji 


AINACTS / 





































































































L2FLUSHREQ 

















i L2 flush | 
2. 





L2FLUSHDONE 








ACINACTM 





STANDBYWFIL2 





Figure 2-11 L2 hardware cache flush timing 


Core dynamic retention 


When a core is in WFI low-power state or WFE low-power state, the clocks to the core are stopped. 
During these low-power states, the core might start the clocks for short periods of time to allow it to 
handle snoops or other short events but it remains in the low-power state. 


Whenever the clocks to a core are stopped, it is possible for an external power controller to place the core 
in a retention state to reduce leakage power consumption without state loss. 


Each core in the processor has a CPU Q-channel interface that allows an external power controller to 
place the core into a retention state. This interface consists of four pins: 


* CPUQACTIVE. 
* CPUQREQn. 
* CPUQACCEPTn. 
«© CPUQDENY. 


The operational relationship of these signals are: 


e CPUQREQn can only go LOW, if CPUQACCEPTn is HIGH and CPUQDENY is LOW. 

e After CPUQREQn goes LOW, it must remain LOW until either CPUQACCEPTn goes LOW or 
CPUQDENY goes HIGH. 

e CPUQREQn can then go HIGH, and must remain HIGH until both CPUQACCEPTn is HIGH and 
CPUQDENY is LOW. 

e Each CPUQREQn request is followed by the assertion of either CPUQACCEPTn or CPUQDENY, 
but not both. CPUQACCEPTn cannot be asserted LOW at the same time as CPUQDENY is 
asserted HIGH. 


For more information, see the ARM*Low Power Interface Specification. 


A typical sequence of the external power controller successfully placing the core in retention state is: 
1. The core executes a WFI instruction. The clocks in the core are stopped and STANDBYWFI is 
asserted. After the programmed number of Generic Timer CNTVALUEB ticks specified by 
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ECTLR[2:0] field has elapsed, the CPUQACTIVE for that core is deasserted. This hints that 
retention is possible for that core. 

2. The external power controller asserts CPUQREQn to indicate that it wants to put that core into 
retention state. 

3. Ifthe core is still in WFI low-power state and the clocks are stopped, the core accepts the retention 
request by asserting CPUQACCEPTn. 

4. While CPUQREQn and CPUQACCEPTn are both asserted, the core is in quiescent state and the 
external power controller can safely put the core into retention state. 

5. During retention, the CPUQACTIVE signal may be asserted to request exit from retention, for 

example if a snoop occurs to access the cache of the quiescent core. 

The external power controller brings the core out of retention and deasserts CPUQREQn. 

The core deasserts CPUQACCEPTn to complete the handshake. 

The clocks in the core are restarted temporarily to allow the snoop request to the core to proceed. 

After the snoop access is complete, and after the programmed number of Generic Timer 

CNTVALUEB ticks specified by ECTLR[2:0] field has elapsed, the CPUQACTIVE for that core is 

deasserted. 

10. CPUQREQn and CPUQACCEPTn are then asserted in sequence. The core has reentered quiescent 
state and the external power controller can put the core into retention state again. 

11. When the core exits WFI low-power state, CPUQACTIVE is asserted. 

12. The power controller brings the core out of retention and CPUQREQn is then deasserted. The core 
exits WFI low-power state, and CPUQACCEPTn is deasserted. 


OPNA 


The following figure shows a typical sequence where the external power controller successfully places 
the core in retention state. 























CPUQACTIVE — @ 2 ©4«C\ = —l 
CPUQREQn ee 
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retention retention 


Figure 2-12 Successful retention timing 


The core enters WFI low-power state and deasserts CPUQACTIVE. The external power controller 
asserts CPUQREQn. If the core cannot safely enter quiescent state, it asserts CPUQDENY instead of 
CPUQACCEPTn. When this occurs, the external power controller cannot put that core into retention 
state. The external power controller must then deassert CPUQREQn, then the core deasserts 
CPUQDENY. 


The following figure shows a sequence where the external power controller attempts to put a core in 
retention state but the core denies the request. 
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Figure 2-13 Denied retention timing 











Guidelines on the use of core dynamic retention 


As cores generally only stay in WFE low-power state for a short period of time, ARM recommends that 
you only take a core into retention when it is in WFI low-power state. 


If the L1 data cache of a core that is in WFI low-power state contains data that is likely to be the target of 
frequent snoops from other cores, entering quiescent state and retention is likely to be inefficient. 


When using the core retention feature, you must consider the following points: 

¢ The Processor dynamic retention control field in the Extended Control Register, ECTLR, must be set 
to a nonzero value to enable this feature. If this field is @b@@@, all assertions of CPUQREQn LOW 
receive CPUQDENY responses. 

e Ifthe core dynamic retention feature is not used, CPUQREQn must be tied HIGH and the ECTLR 
retention control field set to disabled. 


L2 RAMs dynamic retention 


L2 RAM dynamic retention mode provides a way of saving power in an idle processor while allowing 
quick wake-up to service a snoop from ACE. The core supports dynamic retention of the L2 Data, Tag, 
and Replacement RAMs. 


The processor has an L2 Q-channel interface that allows an external power controller to place the L2 
RAMs into a retention state. 


L2 RAM dynamic retention mode is entered and exited using the following sequence of events: 

1. All cores are in WFI or WFE low-power state and therefore, all the cores STANDBYWFI or 
STANDBYWFE outputs are asserted. 

2. When all pending L2 activity is complete, and the L2 remains idle for the programmed number of 
Generic Timer CNTVALUEB ticks, as specified by LZECTLR[2:0] field, the L2 deasserts 
L2QACTIVE. 

3. The external power controller asserts LAQREQn to indicate that it wants to put the L2 RAMs into 
retention state. 

4. If the L2 is still idle, it accepts the retention request by asserting LZAQACCEPTn. 

5. While LZ2QREQn and LZQACCEPTn are both asserted, the power controller can safely put the L2 
RAMs into retention state. 

6. Ifthe L2 detects that one or more cores have exited WFI low-power state, the ACP becomes active, a 
snoop request must be serviced, or there is a debug APB access, the L2 asserts LAQACTIVE to 
request exit from retention. 

7. The power controller brings the L2 RAMs out of retention and deasserts LZAQREQn. 

8. The L2 deasserts LAQACCEPTn to complete the handshake. 


The following figure shows the L2 dynamic retention timing. 
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Figure 2-14 L2 dynamic retention timing 


If the L2 exits idle before step 4 on page 2-47, it asserts LAQDENY instead of L2QACCEPTn. In 
response, the power controller must deassert LAQREQn, causing the L2 to deassert LAQDENY. 


The L2 dynamic retention control field in the L2 Extended Control Register, L2ECTLR, must be set to a 
nonzero value to enable this feature. If this field is @b@@@, all assertions of LZAQREQn LOW receive 
L2QDENY HIGH responses. 


If the L2 dynamic retention feature is not used, L2QREQn must be tied HIGH and the L2ECTLR 
retention control field set to disabled. 
2.4.3 Power modes 


The power domains can be controlled independently to give different combinations of powered-up and 
powered-down domains. 


However, only some power domain state combinations are valid and supported. 


Table 2-4 Supported processor power states on page 2-49 shows the supported power domain states 
for the Cortex-A73 processor. The following table defines the terms used. 


Table 2-3 Power state description 

















Power state | Description 

Off Block is power gated 

Ret Logic or RAM retention power only 

Standby Core is architecturally clock gated at the top of the clock tree 
On Block is active 














Caution 


States not shown in Table 2-4 Supported processor power states on page 2-49 are unsupported and 
must not occur. 
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Table 2-4 Supported processor power states 





Power domains Description 





PDARTEMIS | PDL2RAM | PDCPU<n> 














Off Off Off Cluster off. 

Off On/Ret Off L2 Cache Dormant Mode. 

On Ret Off/Ret/Standby | All cores are off, in Standby, or in Retention state. 
L2 RAMs retained. 

On On Off/Ret/Standby | Processor and L2 RAMs on. 


All cores are off, in standby, or in retention state. 




















On On On Processor on, SCU/L2 RAMs Active. 





You must follow the dynamic power management and powerup and powerdown sequences described in 
the following sections. Any deviation from these sequences can lead to UNPREDICTABLE results. 


Individual core shutdown mode 
In this mode, the PDCPU power domain for an individual core is shut down and all state is lost. 


For full shutdown of the Cortex-A73 processor, including implementations with a single core, see 
Cluster shutdown mode without system driven L2 flush on page 2-50 and Cluster shutdown mode with 
system driven L2 flush on page 2-50. 


To enable a core to be powered down, the implementation must place the core on a separately controlled 
power supply. In addition, you must clamp the outputs of the core to benign values while the entire 
cluster is powered down, to indicate that the core is idle. 


To power down the core, apply the following sequence: 


1. Disable the data cache, by clearing the SCTLR.C bit, or the HSCTLR.C bit if in Hyp mode. This 
prevents more data cache allocations and causes cacheable memory attributes to change to Normal 
Non-cacheable. Subsequent loads and stores do not access the L1 or L2 caches. 

2. Clean and invalidate all data from the L1 data cache to make sure all dirty lines are evicted. 

3. Disable data coherency with other cores in the cluster, by clearing the ECTLR.SMPEN bit. Clearing 
the SMPEN bit enables the core to be taken out of coherency by preventing the core from receiving 
cache or TLB maintenance operations that are broadcast by other cores in the cluster. 

4. Execute an ISB instruction to ensure that all of the register changes from the previous steps have been 
committed. 

5. Execute a DSB SY instruction to ensure that all cache, TLB and branch predictor maintenance 
operations that are issued by any core in the cluster device before the SMPEN bit was cleared have 
completed. 

6. Execute a WFI instruction and wait until the STANDBYWFI output is asserted to indicate that the 

core is the WFI standby state. 

Deassert DBGPWRDUP LOW. This prevents any external debug access to the core. 

Assert nCPUPORESET LOW for at least eight cycles to propagate reset. 

. Activate the core output clamps. 

0. Remove power from the PDCPU power domain. 


Note 
CORECLKEN[CN:0] must be maintained while the core is shut down. 


= oN 
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To power up the core, apply the following sequence: 

1. Ensure DBGPWRDUP is held LOW to prevent any external debug access to the core. 

2. Apply power to the PDCPU power domain. Keep the state of the signals nCPUPORESET and 
DBGPWRDUP LOW. 

Release the core output clamps. 

Deassert resets. 

Assert DBGPWRDUP HIGH to allow external debug access to the core. 

Set the SMPEN bit to | to enable snooping into the core. 

If required, use software to restore the state of the core as it was prior to powerdown. 


PnP YS 


Cluster shutdown mode without system driven L2 flush 


This is the mode where the PDARTEMIS, PDL2RAM, and PDCPU power domains are shut down and 
all state is lost. 


In this section, a lead core is defined as the last core to switch off, or the first core to switch on. To power 
down the cluster, apply the following sequence: 


1. Ensure all non-lead cores are in shutdown mode, see /ndividual core shutdown mode on page 2-49. 

2. Follow steps 1 and 2 in Individual core shutdown mode on page 2-49. 

3. Ifthe ACP interface is configured, ensure that any master connected to the interface does not send 
new transactions, then assert AINACTS. 

4. Clean and invalidate all data from the L2 Data cache. 

Follow steps 3 to 10 in Individual core shutdown mode on page 2-49. 

6. To ensure that the core is removed from system coherency, or that it will no longer receive 
snoop/DVM messages, assert ACINACTM. Then, wait until the STANDBYWFIL2 output is 
asserted to indicate that the L2 memory system is idle. All Cortex-A73 processor implementations 
contain an L2 memory system. 

7. Assert nLZRESET LOW. The nCPUPORESET should already be LOW for all cores at this step. 

Activate the cluster output clamps. 

9. Remove power from the PDARTEMIS and PDL2RAM power domains. 


Note 


For device powerdown, all operations on the lead core must occur after the equivalent step on all non- 
lead cores. 


n 


oo 








To power up the cluster, apply the following sequence: 

1. Hold L2ZRSTDISABLE LOW. 

2. Apply power to the PDARTEMIS and PDL2RAM domains while keeping the nCPUPORESET and 
nL2RESET signals LOW. 

3. Release the cluster output clamps. 

4. The cores can then be powered as required for the Cortex-A73 processor. 


Cluster shutdown mode with system driven L2 flush 


This is the mode where the PDPARTEMIS, PDL2RAM, and PDCPU power domains are shut down and 
all state is lost. 


To power down the cluster, apply the following sequence: 


= 


Ensure that all cores are in shutdown mode, see Individual core shutdown mode on page 2-49. 

2. Ensure that there will not be any ACP transactions. 

3. The SoC asserts the AINACTS signal to idle the ACP. This is necessary to prevent ACP transactions 
from allocating new entries in the L2 cache while the hardware cache flush is occurring. 

Assert LAFLUSHREQ HIGH. 

Hold L2FLUSHREQ HIGH until LAFLUSHDONE is asserted. 

Deassert L2AFLUSHREQ. 

Stop incoming snoops/DVM by disconnecting from coherency. 


Pao S 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 2-50 


reserved. 
Non-Confidential 


2 Functional Description 
2.4 Power management 


8. Assert ACINACTM, then wait until the STANDBYWFIL2 output is asserted to indicate that the L2 
memory system is idle. All Cortex-A73 processor implementations contain an L2 memory system. 

9. For each core in the cluster, assert nCPUPORESET LOW and assert nLZRESET LOW. 

10. Activate the cluster output clamps. 

11. Remove power from the PDARTEMIS and PDL2RAM power domains. 

To power up the cluster, apply the following sequence: 

1. Hold LZARSTDISABLE LOW. 

2. Apply power to the PDARTEMIS and PDL2RAM domains while keeping nCPUPORESET, 
nL2RESET, and L2ERSTDISABLE LOW. 

3. Release the cluster output clamps. 

4. The cores can then be powered as required for the Cortex-A73 processor. 


Dormant mode 


Optionally, the Dormant mode is supported in the cluster. In this mode, all the cores and L2 control logic 
are powered down while the L2 cache RAMs are powered up and retain state. 


The RAM blocks that remain powered up during Dormant mode are: 


e L2 tag RAMs. 
e L2 data RAMs. 
e L2 replacement RAMs. 


To support Dormant mode, you must ensure: 


e The L2 cache RAMs are in a separate power domain. 
e That all inputs to the L2 cache RAMs are clamped to benign values. This avoids corrupting data 
when the cores and L2 control power domains enter and exit power-down state. 


Before entering Dormant mode the architectural state of the cluster, excluding the contents of the L2 
cache RAMs that remain powered up, must be saved to external memory. 


As part of the exit from Dormant mode to Normal state, the SoC must perform a Cold reset sequence. 
The SoC must assert the reset signals until power is restored. After power is restored, the cluster exits the 
Cold reset sequence, and the architectural state must be restored. 


To enter Dormant mode, apply the following sequence: 


1. Disable the data cache, by clearing the SCTLR.C bit, or the HSCTLR.C bit if in Hyp mode. This 
prevents more data cache allocations and causes cacheable memory attributes to change to Normal 
Non-cacheable. Subsequent loads and stores do not access the L1 or L2 caches. 

2. Clean and invalidate all data from the L1 Data cache. The L2 duplicate snoop tag RAM for this core 
is now empty. This prevents any new data cache snoops or data cache maintenance operations from 
other cores in the cluster being issued to this core. 

3. Disable data coherency with other cores in the cluster, by clearing the ECTLR.SMPEN bit. Clearing 
the SMPEN bit enables the core to be taken out of coherency by preventing the core from receiving 
cache or TLB maintenance operations broadcast by other cores in the cluster. 

4. Execute an ISB instruction to ensure that all of the register changes from the previous steps have been 
committed. 

5. Execute a DSB SY instruction to ensure that all cache, TLB and branch predictor maintenance 
operations that are issued by any core in the cluster before the SMPEN bit was cleared have 
completed. In addition, this ensures that all state saving has completed. 

6. Execute a WFI instruction and wait until the STANDBYWFI[CN:0] output is asserted, to indicate 
that the core is in idle and low-power state. 

7. Repeat the previous steps for all cores, and wait for all STANDBYWFI[CN:0] outputs to be 
asserted. 

8. Ifthe ACP interface is configured, ensure that any master connected to the interface does not send 
new transactions, then assert AINACTS. 

9. If ACE is implemented, the SoC asserts the input pin ACINACTM to idle the AXI master interface 
after all snoop transactions have been sent on the interface. 
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When the L2 has completed the outstanding transactions for the AXI master and slave interfaces, 
STANDBYWFIL2 is asserted to indicate that the L2 memory system is idle. All Cortex-A73 
processor implementations contain an L2 memory system. 

10. When all cores STANDBYWFI[n] and STANDBYWFIL2 are asserted, the cluster is ready to enter 
Dormant mode. 

11. Activate the L2 cache RAM output clamps. 

12. For each core in the cluster, assert nCPUPORESET LOW and assert nLZRESET LOW. 

13. Remove power from the PDCPU and PDARTEMIS power domains. 

To exit Dormant mode, apply the following sequence: 

1. Apply a Cold reset sequence. You must apply resets to the cores and the L2 memory system logic 
until power is restored. During this reset sequence, LARSTDISABLE must be held HIGH to disable 
the L2 cache hardware reset mechanism. 

2. When power has been restored, release the L2 cache RAM input clamps. 

3. Continue the Cold reset sequence with LARSTDISABLE held HIGH. 

4. The architectural state must be restored, if required. 
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Programmers Model 


This chapter describes the registers and provides information for programming the Cortex-A73 
processor. 
It contains the following sections: 


e 3.1 About the programmers model on page 3-54. 
e 3.2 ARMV8-A architecture concepts on page 3-56. 
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3.1 About the programmers model 
The Cortex-A73 processor implements the ARMv8-A architecture. This includes: 


e Support for all the Exception levels, ELO-EL3. 
e Support for both Execution states, AArch64 and AArch32, at each Exception level. 
e The following instruction sets: 


AArch64 Execution state 
The A64 instruction set. 
AArch32 Execution state 
The T32 and A32 instruction sets. 
e Optionally, an implementation can include The Cryptographic Extension, which provides additional 
instructions in all instruction sets. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


This section contains the following subsections: 


¢ 3.1.1 Advanced SIMD and Floating-point support on page 3-54. 
¢ 3.1.2 Memory model on page 3-54. 

¢ 3.1.3 Jazelle implementation on page 3-55. 

¢ 3.1.4 Modes of operation on page 3-55. 


3.1.1 Advanced SIMD and Floating-point support 


Advanced SIMD is a media and signal processing architecture that adds instructions targeted primarily at 
audio, video, 3-D graphics, image, and speech processing. 
Floating-point performs single-precision and double-precision floating-point operations. 

Note 


Advanced SIMD, its associated implementations, and supporting software, are commonly referred to as 
NEON. 








All scalar floating-point instructions are available in the A64 instruction set. All VFP instructions are 
available in the A32 and T32 instruction sets. 


The same Advanced SIMD instructions are available in both the A32 and T32 instruction sets. The A64 
instruction set offers additional Advanced SIMD instructions, including double-precision floating-point 
vector operations. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


See Chapter 14 Advanced SIMD and Floating-point Support on page 14-543 for implementation- 
specific information. 


3.1.2 Memory model 


The Cortex-A73 processor views memory as a linear collection of bytes numbered in ascending order 
from zero. For example, bytes 0-3 hold the first stored word, and bytes 4-7 hold the second stored word. 


The processor can store words in memory as either: 


e Big-endian format. 
e Little-endian format. 
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See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about big-endian and little-endian memory systems. 
Note 


Instructions are always little-endian. 








3.1.3 Jazelle implementation 
The processor supports a trivial Jazelle implementation. This means: 


e Jazelle state is not supported. 
e The BX] instruction behaves as a BX instruction. 


In the trivial Jazelle implementation, the core does not accelerate the execution of any bytecodes, and the 
JVM uses software routines to execute all bytecodes. See the ARM® Architecture Reference Manual 
ARMV6, for ARMV8-A architecture profile for more information. 


3.1.4 Modes of operation 


In AArch32, the core has the following instruction set operating states controlled by the T bit and J bit in 
the CPSR. 


A32 The processor executes 32-bit, word-aligned A32 instructions. 
T32 The processor executes 16-bit and 32-bit, halfword-aligned T32 instructions. 


The J bit and the T bit determine the instruction set used by the processor. The following table shows the 
encoding of these bits. 


Table 3-1 CPSR J and T bit encoding 





JÍT | Instruction set state 





0 | 0 | A32 





0) 1 | 132 

















Note 


¢ The processor does not support Jazelle state. This means there is no processor state where the J bit is 
1 and T bit is 0. 

¢ The processor does not support T32EE state. This means there is no processor state where the J bit is 
1 and T bit is 1. 

¢ Transition between A32 and T32 instruction set states does not affect the processor mode or the 
register contents. 











ARM 100048 0002 _05_ en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 3-55 
reserved. 
Non-Confidential 


3 Programmers Model 
3.2 ARMv8-A architecture concepts 


3.2 ARMv8-A architecture concepts 


The following sections describe the ARMv8-A architectural concepts. Each section introduces the 
corresponding terms that are used to describe the architecture. 





Note 


A thorough understanding of the terminology defined in this section is a prerequisite for reading the 
remainder of this manual. 





This section contains the following subsections: 

e 3.2.1 Execution state on page 3-56. 

e 3.2.2 Exception levels on page 3-57. 

e 3.2.3 Security state on page 3-58. 

e 3.2.4 Rules for changing execution state on page 3-59. 
e 3.2.5 Stack pointer selection on page 3-59. 

e 3.2.6 ARMV8 security model on page 3-60. 

e 3.2.7 Instruction set state on page 3-62. 

e 3.2.8 AArch32 execution modes on page 3-62. 


3.2.1 Execution state 
The execution state defines the processor execution environment, including: 


¢ Supported register widths. 

¢ Supported instruction sets. 

e Significant aspects of: 
— The execution model. 
— The Virtual Memory System Architecture (VMSA). 
— The programmers model. 


The execution states are: 


AArch64 

The 64-bit execution state. This execution state: 

e Features 31 64-bit general purpose registers, with a 64-bit Program Counter (PC), Stack 
Pointer (SP), and Exception Link Registers (ELRs). 

e Provides a single instruction set, A64. For more information, see 3.2.7 Instruction set state 
on page 3-62. 

e Defines the ARMv8 exception model, with four exception levels, ELO-EL3, that provide an 
execution privilege hierarchy. 

e Features Virtual Addresses (VAs) held in 64-bit registers. The Cortex-A73 VMSA 
implementation maps these to 40-bit Physical Address (PA) maps. 

¢ Defines a number of PSTATE elements that hold processor state. The A64 instruction set 
includes instructions that operate directly on various PSTATE elements. 

e Names each system register using a suffix that indicates the lowest exception level at which 
the register can be accessed. 
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AArch32 

The 32-bit execution state. This execution state is backwards-compatible with implementations 

of the ARMv7-A architecture profile that include the Security Extensions and the Virtualization 

Extensions: 

e Features 13 32-bit general purpose registers, and a 32-bit PC, SP, and link register (LR). 
Some of these registers have multiple banked instances for use in different processor modes. 

¢ Provides two instruction sets, A32 and T32. For more information, see 3.2.7 Instruction set 
state on page 3-62. 

e Provides an exception model that maps the ARMv7 exception model onto the ARMv8 
exception model and Exception levels. For exceptions taken to an Exception level that is 
using AArch32, this supports the ARMv7 exception model use of processor modes. 

e Features 32-bit VAs. The VMSA maps these to PA maps that can support PAs of up to 40 
bits. 

e Collects processor state into the Current Program State Register (CPSR). 


The processor can move between Execution states only on a change of Exception level, and subject to 
the rules given in 3.2.4 Rules for changing execution state on page 3-59. This means different software 
layers, such as an application, an operating system kernel, and a hypervisor, executing at different 
Exception levels, can execute in different Execution states. 


3.2.2 Exception levels 
The ARMv8 exception model defines exception levels ELO-EL3, where: 


e ELO has the lowest software execution privilege, and execution at ELO is called unprivileged 
execution. 

e Increased exception levels, from 1 to 3, indicate increased software execution privilege. 

e EL2 provides support for processor virtualization. 

e EL3 provides support for a Secure state, see 3.2.3 Security state on page 3-58. 


The Cortex-A73 processor implements all the Exception levels, ELO-EL3, and supports both Execution 
states, AArch64 and AArch32, at each Exception level. 


Execution can move between Exception levels only on taking an exception, or on returning from an 
exception: 


e On taking an exception, the Exception level either increases or remains the same. The Exception level 
cannot decrease on taking an exception. 

e On returning from an exception, the Exception level either decreases or remains the same. The 
Exception level cannot increase on returning from an exception. 


The Exception level that execution changes to, or remains in, on taking an exception, is called the target 
Exception level of the exception, and: 
e Every exception type has a target Exception level that is either: 
— Implicit in the nature of the exception. 
— Defined by configuration bits in the system registers. 
e An exception cannot target the ELO Exception level. 


Exception levels, and privilege levels, are defined within a particular Security state, and 3.2.6 ARMv8 
security model on page 3-60 describes the permitted combinations of Security state and Exception 
level. 


Exception terminology 


This section defines terms used to describe the navigation between exception levels. 


Terminology for taking an exception 


An exception is generated when the processor first responds to an exceptional condition. 
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The processor state at this time is the state the exception is taken from. The processor state immediately 
after taking the exception is the state the exception is taken to. 


Terminology for returning from an exception 


To return from an exception, the processor must execute an exception return instruction. The processor 
state when an exception return instruction is committed for execution is the state the exception returns 
from. The processor state immediately after the execution of that instruction is the state the exception 
returns to. 


Exception level terminology 


An Exception level, ELn, with a larger value of n than another Exception level, is described as being a 
higher Exception level than the other Exception level. For example, EL3 is a higher Exception level than 
EL1. 


An Exception level with a smaller value of n than another Exception level is described as being a lower 
Exception level than the other Exception level. For example, ELO is a lower Exception level than EL1. 


An Exception level is described as: 


e Using AArch64 when execution in that Exception level is in the AArch64 Execution state. 
e Using AArch32 when execution in that Exception level is in the AArch32 Execution state. 


Typical exception level usage model 


The architecture does not specify what software uses the different Exception levels, and such choices are 
outside the scope of the architecture. However, the following is a common usage model for the Exception 
levels: 


ELO Applications. 

EL1 OS kernel and associated functions that are typically described as privileged. 
EL2 Hypervisor. 

EL3 Secure monitor. 


3.2.3 Security state 


An ARMv8 implementation that includes the EL3 Exception level provides the following Security states, 
each with an associated memory address space: 


Secure state 
In Secure state, the processor: 
e Can access both the Secure memory address space and the Non-secure memory address 
space. 
e When executing at EL3, can access all the system control resources. 


Non-secure state 
In Non-secure state, the processor: 
e Can access only the Non-secure memory address space. 
e Cannot access the Secure system control resources. 


The AArch32 Security state model is unchanged from the model for an ARMv7 implementation that 
includes the Security Extensions and the Virtualization Extensions. When the implementation uses the 
AArch32 Execution state for all Exception levels, many system registers are banked to provide Secure 
and Non-secure instances, and: 

e The Secure instance is accessible only at EL3. 

¢ The Non-secure instance is accessible at EL1 or higher. 

e The two instances of a banked register have the same name. 


The 3.2.6 ARMV8 security model on page 3-60 describes how the Security state interacts with other 
aspects of the ARMv8 architectural state. 
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3.2.4 Rules for changing execution state 


This introduction to moving between execution states does not consider exceptions caused by debug 
events. 


The execution state, AArch64 or AArch32, can change only on a change of exception level, meaning it 
can change only on either: 


e Taking an exception to a higher exception level. 
e Returning from an exception to a lower exception level. 
Note 


The execution state cannot change if, on taking an exception or on returning from an exception, the 
exception level remains the same. 








On taking an exception to a higher exception level, the execution state: 


e Can either: 


— Remain the same. 
— Increase from AArch32 state to AArch64 state. 
e Cannot decrease from AArch64 state to AArch32 state. 


On returning from an exception to a lower exception level, the execution state: 


e Can either: 


— Remain the same. 
— Decrease from AArch64 state to AArch32 state. 
e Cannot increase from AArch32 state to AArch64 state. 


On powerup and on reset, the processor enters EL3, the highest exception level. The execution state for 
this exception level is a property of the implementation, and is determined by a configuration input 
signal. For the other exception levels the execution state is determined as follows: 

¢ For an exception return to ELO, the ELO execution state is specified as part of the exception return, 


subject to the rules given in this section. 
e Otherwise, the execution state is determined by one or more system register configuration bits, that 
can be set only in a higher exception level. 
3.2.5 Stack pointer selection 


Stack pointer behavior depends on the execution state, as follows: 


AArch64 
In ELO, the stack pointer, SP, maps to the SP_ELO stack pointer register. 


Taking an exception selects the default stack pointer for the target exception level, meaning SP 
maps to the SP_ELx stack pointer register, where x is the exception level. 


Software executing in the target exception level can execute an MSR SPSel, #Imm1 instruction 
to select whether to use the default SP_ELx stack pointer, or the SP_ELO stack pointer. 


The selected stack pointer can be indicated by a suffix to the exception level: 
t Indicates use of the SP_ELO stack pointer. 
h Indicates use of the SP_ELx stack pointer. 


The following table shows the set of AArch64 stack pointer options. 
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Table 3-2 AArch64 stack pointer options 

















Exception level | AArch64 stack pointer options 
ELO ELOt 

ELI ELit, EL1h 

EL2 EL2t, EL2h 

EL3 EL3t, EL3h 














AArch32 
In AArch32 state, each mode that can be the target of an exception has its own banked copy of 
the stack pointer. For example, the banked stack pointer for Hyp mode is called SP_hyp. 
Software executing in one of these modes uses the banked stack pointer for that mode. 


The modes that have banked copies of the stack pointer are FIQ mode, IRQ mode, Supervisor 
mode, Abort mode, Undefined mode, Hyp mode, and Monitor mode. Software executing in 
User mode or System mode uses the User mode stack pointer, SP_usr. 


For more information, see 3.2.8 AArch32 execution modes on page 3-62. 


3.2.6 ARMv8 security model 
The Cortex-A73 processor implements all of the exception levels. This means: 


e EL3 exists only in Secure state and a change from Secure state to Non-secure state is made only by 
an exception return from EL3. 
e EL2 exists only in Non-secure state. 


To provide compatibility with ARMv7, the exception levels available in Secure state are modified when 
EL3 is using AArch32. The following sections describe the security model: 

e Security model when EL3 is using AArch64 on page 3-60. 

¢ Security model when EL3 is using AArch32 on page 3-61. 


Security model when EL3 is using AArch64 


The following figure shows the security model and the expected use of the different exception levels 
when EL3 is using AArch64, as well as how instances of ELO and EL1 are present in both security 
states. 
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EL1 


EL2 


EL3 
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Secure state 


Non-secure state 











AArch32 or AArch64* AArch32 or AArch64* AArch32 or AArch64 


Guest OS1 Guest OS2 Secure OS 























t AArch64 permitted only if EL1 is using AArch64 
$ AArch64 permitted only if EL2 is using AArch64 


Figure 3-1 ARMv8 security model when EL3 is using AArch64 


Security model when EL3 is using AArch32 


To provide software compatibility with VMSAv7 implementations that include the security extensions, in 
Secure AArch32 state, all modes other than User mode have the same execution privilege. 


This means that, in an implementation where EL3 is using AArch32, the security model is as shown in 
the following figure. This figure also shows the expected use of the different exception levels and 
processor modes. 
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ELO 


EL1 


EL2 


EL3 


3.2.7 


3.2.8 


Non-secure state 











AArch32 
Guest OS1 


System, FIQ, IRQ, 
Supervisor, Abort, Undefined 








AArch32 
Guest OS2 


System, FIQ, IRQ, 
Supervisor, Abort, Undefined 











3 Programmers Model 
3.2 ARMv8-A architecture concepts 


Secure state 








Figure 3-2 ARMv8 security model when EL3 is using AArch32 


For more information about the AArch32 processor modes see 3.2.8 AArch32 execution modes 


on page 3-62. 


Instruction set state 


The processor instruction set state determines the instruction set that the processor executes. 


The instruction sets depend on the execution state: 


AArch64 


AArch64 state supports only a single instruction set, called A64. This is a fixed-width 
instruction set that uses 32-bit instruction encodings. 


AArch32 


AArch32 state supports the following instruction sets: 


A32 


This is a fixed-length instruction set that uses 32-bit instruction encodings. Before the 


introduction of ARMv8, it was called the ARM instruction set. 


T32 


This is a variable-length instruction set that uses both 16-bit and 32-bit instruction 


encodings. Before the introduction of ARMv8, it was called the Thumb instruction set 


state. 


AArch32 execution modes 


ARMv/7 and earlier versions of the ARM architecture define a set of named processor modes, including 
modes that correspond to different exception types. 


For compatibility, AArch32 state retains these processor modes. 


The following table shows the AArch32 processor modes, and the exception level of each mode. 
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3 Programmers Model 
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Table 3-3 AArch32 processor modes and associated exception levels 


























AArch32 processor mode EL3 using Security state Exception level 
User AArch32 or AArch64 | Non-secure or Secure | ELO 
System, FIQ, IRQ, Supervisor, Abort, Undefined | AArch64 Non-secure or Secure | EL1 
AArch32 Non-secure ELI 
Secure EL3 
Hyp AArch32 or AArch64 | Non-secure only EL2 
Monitor AArch32 Secure only EL3 














When the EZ3 using column of the above table shows: 


AArch64 
The row refers to information shown in Figure 3-1 ARMv8 security model when EL3 is using 
AArch64 on page 3-61. 

AArch32 
The row refers to information shown in Figure 3-2 ARMv8 security model when EL3 is using 
AArch32 on page 3-62. 


A processor mode name does not indicate the current security state. To distinguish between a mode in 
Secure state and the equivalent mode in Non-secure state, the mode name is qualified as Secure or Non- 
secure. For example, a description of AArch32 operation in EL1 might reference the Secure FIQ mode, 
or to the Non-secure FIQ mode. 
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Chapter 4 
System Control 


Describes the system registers, their structure, operation, and how to use them. 


It contains the following sections: 

¢ 4.1 About system control on page 4-65. 

e 4.2 AArch64 register summary on page 4-66. 

e 4.3 AArch64 register descriptions on page 4-80. 
e 4.4 AArch32 register summary on page 4-189. 

e 4.5 AArch32 register descriptions on page 4-213. 
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4.1 About system control 


The system registers control and provide status information for the functions implemented in the 
processor. 


The main functions of the system registers are: 


e Overall system control and configuration. 

e Memory Management Unit (MMU) configuration and management. 
e Cache configuration and management. 

e System performance monitoring. 

e GIC configuration and management. 


The system registers are accessible in AArch64 and AArch32 Execution states. The execution states are 
described in 3.2 ARMv8-A architecture concepts on page 3-56. 


The system registers accessed in the AArch64 Execution state are described in 4.3 AArch64 register 
descriptions on page 4-80. 


The system registers accessed in the AArch32 Execution state are described in 4.5 AArch32 register 
descriptions on page 4-213. 


Some of the system registers can be accessed through the memory-mapped or external debug interfaces. 


Bits in the system registers that are described in the ARMv7 architecture are redefined in the ARMv8-A 
architecture: 

e UNK/SBZP, RAZ/SBZP, and RAZ/WI are redefined as RESO. 

e UNK/SBOP and RAO/SBOP are redefined as REs1. 


RESO and RES! are described in the ARM® Architecture Reference Manual ARMV8, for ARMv8-A 
architecture profile. 


For more information on the execution states, see the ARM® Architecture Reference Manual ARMV8, for 
ARMV8-A architecture profile. 
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4 System Control 
4.2 AArch64 register summary 


This section gives a summary of the system registers in the AArch64 Execution state. 


For more information on using the system registers, see the ARM® Architecture Reference Manual 


ARMV8, for ARMv8-A architecture profile. 


This section contains the following subsections: 

e 4.2.1 AArch64 identification registers on page 4-66. 

e 4.2.2 AArch64 exception handling registers on page 4-69. 

e 4.2.3 AArch64 virtual memory control registers on page 4-69. 

e 4.2.4 AArch64 other system control registers on page 4-70. 

e 4.2.5 AArch64 cache maintenance operations on page 4-71. 

e 4.2.6 AArch64 TLB maintenance operations on page 4-71. 

e 4.2.7 AArch64 address translation operations on page 4-72. 

e 4.2.8 AArch64 miscellaneous operations on page 4-72. 

e 4.2.9 AArch64 performance monitor registers on page 4-73. 

e 4.2.10 AArch64 reset registers on page 4-74. 

e 4.2.11 AArch64 Secure registers on page 4-74. 

e 4.2.12 AArch64 virtualization registers on page 4-75. 

e 4.2.13 AArch64 EL2 TLB maintenance operations on page 4-76. 
e 4.2.14 AArch64 GIC system registers on page 4-76. 

e 4.2.15 AArch64 Generic Timer registers on page 4-78. 

e 4.2.16 AArch64 thread registers on page 4-78. 

e 4.2.17 AArch64 implementation defined registers on page 4-78. 
e 4.2.18 AArch64 implementation defined operations on page 4-79. 


4.2.1 AArch64 identification registers 


The following table shows the identification registers in AArch64 state. Bits[63:32] are reset to 


0x00000009 for all 64-bit registers: 


Table 4-1 AArch64 identification registers 





Name Type Reset Width 


Description 





MIDR EL1 RO 0x410FD091 32 


4.3.1 Main ID Register, 
ELI on page 4-81 





MPIDR_EL1 RO -b 64 


4.3.2 Multiprocessor 
Affinity Register 
on page 4-82 





REVIDR_ EL1 RO 0x00000000 32 


4.3.3 Revision ID Register 
on page 4-84 





ID_PFRO_EL1 RO @x00000131 32 


4.3.4 AArch32 Processor 
Feature Register 0 
on page 4-85 





ID_PFR1 ELI RO 0x10011011° 32 


4.3.5 AArch32 Processor 
Feature Register 1 
on page 4-86 





ID_DFRO ELI RO @x03010066 32 














4.3.6 AArch32 Debug 
Feature Register 0 





on page 4-87 








b The reset value depends on the primary inputs, CLUSTERIDAFF1 and CLUSTERIDAFF2, and the number of cores that the device implements. 


© Bits [31:28] are @x1 if the GIC CPU interface is enabled, and @x@ otherwise. 
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4 System Control 
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Table 4-1 AArch64 identification registers (continued) 





Name Type Reset Width Description 





ID_AFRO EL1 RO 0x00000000 32 4.3.7 AArch32 Auxiliary 
Feature Register 0 
on page 4-88 





ID_MMFRO EL1 RO @x10201105 32 4.3.8 AArch32 Memory 
Model Feature Register 0 
on page 4-88 





ID_MMERI1 EL1 RO 0x40000000 32 4.3.9 AArch32 Memory 
Model Feature Register 1 
on page 4-90 





ID_MMFR2_EL1 RO 0x01260000 32 4.3.10 AArch32 Memory 
Model Feature Register 2 
on page 4-91 





ID_MMFR3_EL1 RO 0x02102211 32 4.3.11 AArch32 Memory 
Model Feature Register 3 
on page 4-93 





ID_ISARO0_EL1 RO 0x02101110 32 4.3.12 AArch32 Instruction 
Set Attribute Register 0 
on page 4-94 





ID_ISAR1_EL1 RO 0x13112111 32 4.3.13 AArch32 Instruction 
Set Attribute Register 1 
on page 4-95 





ID_ISAR2_EL1 RO 0x21232042 32 4.3.14 AArch32 Instruction 
Set Attribute Register 2 
on page 4-97 





ID_ISAR3_EL1 RO 0x01112131 32 4.3.15 AArch32 Instruction 
Set Attribute Register 3 
on page 4-99 





ID_ISAR4 EL1 RO 0x00011142 32 4.3.16 AArch32 Instruction 
Set Attribute Register 4 
on page 4-100 





ID_ISAR5_EL1 RO 0x00011121 or 32 4.3.17 AArch32 Instruction 
0x00010001t Set Attribute Register 5 
on page 4-101 





ID_MMFR4 EL1 RO 0x00000000 32 4.3.18 AArch32 Memory 
Model Feature Register 4 
on page 4-103 





ID_AA64PFRO_EL1 RO 0x01002222° 64 4.3.19 AArch64 Processor 
Feature Register 0 
on page 4-104 





ID_AA64PFR1 ELI] RO 0x00000000 64 4.3.20 AArch64 Processor 
Feature Register 1 
on page 4-105 























d The value is @x@0011121 if the Cryptographic Extension is implemented and enabled. The value is 0x00010001 if the Cryptographic Extension is not 


implemented or enabled. 
e Bits [27:24] are @x1 if the GIC CPU interface is enabled, and @x@ otherwise. 
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Table 4-1 AArch64 identification registers (continued) 



























































Name Type Reset Width Description 
ID_AA64DFRO EL1 RO 0x10305106 64 4.3.21 AArch64 Debug 
Feature Register 0, ELI 
on page 4-106 
ID_AA64DFRI1 EL1 RO 0x00000000 64 4.3.22 AArch64 Debug 
Feature Register 1 
on page 4-107 
ID_AA64AFRO EL1 RO 0x00000000 64 4.3.23 AArch64 Auxiliary 
Feature Register 0 
on page 4-107 
ID_AA64AFR1_EL1 RO 0x00000000 64 4.3.24 AArch64 Auxiliary 
Feature Register 1 
on page 4-107 
ID_AA64ISARO EL1 RO @x@0011120 or 64 4.3.25 AArch64 Instruction 
0x00010000f Set Attribute Register 0, 
ELI on page 4-107 
ID_AA64ISAR1_EL1 RO 0x00000000 64 4.3.26 AArch64 Instruction 
Set Attribute Register 1, 
ELI on page 4-109 
ID_AA64MMFRO_EL1 RO 0x00101122 64 4.3.27 AArch64 Memory 
The supported Physical se goad aad 0, 
Address Range is 40-bit. yee 
ID_AA64MMFRI1_ EL1 RO 0x00000000 64 4.3.28 AArch64 Memory 
Model Feature Register 1 
on page 4-110 
CCSIDR_EL1 RO UNKS& 32 4.3.29 Cache Size ID 
Register on page 4-110 
CLIDR_EL1 RO 0x0A200023 64 4.3.30 Cache Level ID 
Register on page 4-112 
AIDR_EL1 RO 0x00000000 32 4.3.31 Auxiliary ID 
Register on page 4-113 
CSSELR_EL1 RW UNK 32 4.3.32 Cache Size Selection 
Register on page 4-113 
CTR_ELO RO 0x84448004 32 4.3.33 Cache Type Register 
on page 4-115 
DCZID_ELO RO 0x00000004 32 4.3.34 Data Cache Zero ID 


Register on page 4-116 











f 


implemented or enabled. 


8 The reset value depends on the implementation. See the register description for details. 


The value is @x@0@11120 if the Cryptographic Extension is implemented and enabled. The value is @x@00100@0 if the Cryptographic Extension is not 
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Table 4-1 AArch64 identification registers (continued) 

















































































































Name Type Reset Width Description 
VPIDR_EL2 RW 0x410FD091 32 4.3.35 Virtualization 
Processor ID Register 
on page 4-117 
VMPIDR_EL2 RO 64 4.3.36 Virtualization 
Multiprocessor ID Register 
on page 4-117 
4.2.2 AArch64 exception handling registers 
The following table shows the fault handling registers in AArch64 state. 
Table 4-2 AArch64 exception handling registers 
Name Type | Reset Width | Description 
AFSRO_EL1 |RW_ | 0x000000@8 | 32 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158 
AFSR1_EL1 | RW | 0x00000088 | 32 4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158 
ESR_EL1 RW |UNK 32 4.3.64 Exception Syndrome Register, EL] on page 4-158 
IFSR32_EL2|RW |UNK 32 4.3.65 Instruction Fault Status Register, EL2 on page 4-159 
AFSRO_EL2 |RW_ | 0x00000088 | 32 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158 
AFSR1_EL2 | RW _ | 0x@00000@8 | 32 4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158 
ESR_EL2 RW |UNK 32 4.3.66 Exception Syndrome Register, EL2 on page 4-163 
AFSRO_EL3 | RW _ | 0x@00000@8 | 32 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158 
AFSR1_EL3 | RW _ | 0x@00000@8 | 32 4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158 
ESR_EL3 RW |UNK 32 4.3.67 Exception Syndrome Register, EL3 on page 4-164 
FAR ELI RW |UNK 64 4.3.68 Fault Address Register, ELI on page 4-165 
FAR _EL2 RW |UNK 64 4.3.69 Fault Address Register, EL2 on page 4-166 
HPFAR EL2}RW |UNK 64 4.3.70 Hypervisor IPA Fault Address Register, EL2 on page 4-167 
FAR_EL3 RW |UNK 64 4.3.73 Fault Address Register, EL3 on page 4-172 
VBAR EL] [RW | UNK 64 4.3.78 Vector Base Address Register, EL] on page 4-178 
ISR_EL1 RO | UNK 32 4.3.53 Interrupt Status Register on page 4-182 
VBAR EL2 |RW | UNK 64 4.3.79 Vector Base Address Register, EL2 on page 4-179 
VBAR EL3 |RW | UNK 64 4.3.80 Vector Base Address Register, EL3 on page 4-180 
4.2.3 AArch64 virtual memory control registers 


The following table shows the virtual memory control registers in AArch64 state. 





h 


The reset value is the value of the Multiprocessor Affinity Register. 
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Table 4-3 AArch64 virtual memory control registers 






















































































Name Type | Reset Width | Description 

SCTLR_EL1 RW | 0x9eCc5e838! | 32 4.3.37 System Control Register, EL1 on page 4-118 

SCTLR_EL2 RW | UNK 32 4.3.42 System Control Register, EL2 on page 4-125 

SCTLR_EL3 RW | @x9eC5e838' | 32 4.3.48 System Control Register, EL3 on page 4-138 

TTBRO_EL1 RW |UNK 64 4.3.51 Translation Table Base Register 0, EL1 on page 4-142 

TTBR1_EL1 RW |UNK 64 4.3.52 Translation Table Base Register 1 on page 4-143 

TCR_EL1 RW |UNK 64 4.3.55 Translation Control Register, EL1 on page 4-147 

TTBRO_EL2 RW |UNK 64 Translation Table Base Address Register 0, EL2/ 

TCR_EL2 RW |UNK 32 4.3.56 Translation Control Register, EL2 on page 4-150 

VTTBR_EL2 RW |UNK 64 Virtualization Translation Table Base Address Register, EL2/ 

VTCR_EL2 RW |UNK 32 4.3.57 Virtualization Translation Control Register, EL2 on page 4-152 

TTBRO_EL3 RW |UNK 64 4.3.59 Translation Table Base Register 0, EL3 on page 4-155 

TCR_EL3 RW | 0xeeeeeeee | 32 4.3.60 Translation Control Register, EL3 on page 4-156 

MAIR EL1 RW |UNK 64 4.3.75 Memory Attribute Indirection Register, ELI on page 4-175 

AMAIR EL1 RW_ | 0xee0e8800 | 64 4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 
on page 4-158 

MAIR EL2 RW |UNK 64 4.3.76 Memory Attribute Indirection Register, EL2 on page 4-177 

AMAIR EL2 RW |@©x00000000 | 64 4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 
on page 4-158 

MAIR EL3 RW | UNK 64 4.3.77 Memory Attribute Indirection Register, EL3 on page 4-177 

AMAIR EL3 RW | 0xeeeeeeee | 64 4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 
on page 4-158 

CONTEXTIDR EL1|RW | UNK 32 Context ID Register, EL1 








4.2.4 


AArch64 other system control registers 


The following table shows the other system control registers in AArch64 state. 


Table 4-4 AArch64 other system control registers 




















Name Type | Reset Width | Description 

ACTLR_EL1]RW_ | 0x00000000 | 32 4.3.38 Auxiliary Control Register, EL1 on page 4-121 

CPACR_EL1 | RW _ | 0x000000@80 | 32 4.3.41 Architectural Feature Access Control Register on page 4-124 
ACTLR_EL2|RW_ | 0x0000008 | 32 4.3.39 Auxiliary Control Register, EL2 on page 4-121 
ACTLR_EL3|RW_ | 0x000000@8 | 32 4.3.40 Auxiliary Control Register, EL3 on page 4-123 























! The reset value depends on primary inputs VINITHI, CFGTE and CFGEND. The information in this table assumes these signals are LOW. 
J See the ARM” Architecture Reference Manual ARMV6, for ARMv8-A architecture profile. 
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4.2.6 


4 System Control 
4.2 AArch64 register summary 


AArch64 cache maintenance operations 


The following table shows the System instructions for cache and maintenance operations in AArch64 
state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for more 
information about these operations. 


Table 4-5 AArch64 cache maintenance operations 





Name Description 





IC IALLUTS | Instruction cache invalidate all to PoU Inner Shareable 





Ic IALLU Instruction cache invalidate all to PoU 





Ic IVAU Instruction cache invalidate by virtual address (VA) to PoU 





DC IVAC Data cache invalidate by VA to PoC! 





DC ISW Data cache invalidate by set/way 





DC CSW Data cache clean by set/way 





DC CISW Data cache clean and invalidate by set/way 





DC ZVA Data cache zero by VA 





DC CVAC Data cache clean by VA to PoC 





DC CVAU Data cache clean by VA to PoU 





DC CIVAC Data cache clean and invalidate by VA to PoC 














AArch64 TLB maintenance operations 


The following table shows the System instructions for TLB maintenance operations in AArch64 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 


Table 4-6 AArch64 TLB maintenance operations 





Name 


Description 





TLBI VMALLE1IS 


Invalidate all stage 1 translations used at EL1 with the current virtual machine identifier (VMID) in the Inner 
Shareable 





TLBI 


VAE1IS 


Invalidate translation used at EL1 for the specified VA and Address Space Identifier (ASID) and the current 
VMID, Inner Shareable 





TLBI 


ASIDE1IS 


Invalidate all translations used at EL1 with the current VMID and the supplied ASID, Inner Shareable 





TLBI 


VAAE1IS 


Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values, Inner 
Shareable 





TLBI 


VALE1IS 


Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 
current VMID, Inner Shareable 





TLBI 


VAALE1IS 


Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 
current VMID and for all ASID values, Inner Shareable 





TLBI 





VMALLE1 





Invalidate all stage 1 translations used at EL1 with the current VMID 











PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside of the processor, in which case PoU is 
dependent on the external memory system. 
PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the external memory system. 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-71 


reserved. 
Non-Confidential 


4 System Control 
4.2 AArch64 register summary 


Table 4-6 AArch64 TLB maintenance operations (continued) 





Name 


Description 





TLBI VAE1 


Invalidate translation used at EL1 for the specified VA and ASID and the current VMID 





TLBI ASIDE1 


Invalidate all translations used at EL1 with the current VMID and the supplied ASID 





TLBI VAAE1 


Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values 





TLBI VALE1 


current VMID 


Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 








TLBI VAALE1 


current VMID and for all ASID values 





Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 








4.2.7 


4.2.8 


The Virtualization registers include additional TLB operations for use in Hyp mode. For more 
information, see 4.2.13 AArch64 EL2 TLB maintenance operations on page 4-76. 


AArch64 address translation operations 


The following table shows the address translation register in AArch64 state. 


Table 4-7 AArch64 address translation register 





Name 


Type 


Reset 


Width 


Description 





PAR EL] | RW 








UNK 








64 





4.3.74 Physical Address Register, ELI on page 4-173 








The following table shows the System instructions for address translation operations in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


information. 


AArch64 miscellaneous operations 


Table 4-8 AArch64 address translation operations 












































Name Description 

AT S1E1R | Stage 1 current state EL1 read 

AT S1E1W | Stage 1 current state EL1 write 

AT S1E®R | Stage 1 current state unprivileged read 

AT S1E@W | Stage 1 current state unprivileged write 

AT S1E2R | Stage 1 Hyp mode read 

AT S1E2W | Stage 1 Hyp mode write 

AT S12E1R | Stages 1 and 2 Non-secure EL1 read 

AT S12E1W | Stages 1 and 2 Non-secure EL1 write 

AT S12E®R | Stages 1 and 2 Non-secure unprivileged read 
AT S12E@W | Stages 1 and 2 Non-secure unprivileged write 
AT S1E3R | Stage 1 current state EL3 read 

AT S1E3W | Stage 1 current state EL3 write 











The following table shows the miscellaneous operations in AArch64 state. 
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information about these operations. 


Table 4-9 AArch64 miscellaneous System operations 




















































































































Name Type | Reset | Width | Description 
TPIDR_ELO RW |UNK |64 Thread Pointer / ID Register, ELO 
TPIDR _EL1 RW |UNK |64 Thread Pointer / ID Register, EL1 
TPIDRRO_ ELO|RW™|UNK_ |64 Thread Pointer / ID Register, Read-Only, ELO 
TPIDR EL2 RW |UNK |64 Thread Pointer / ID Register, EL2 
TPIDR_EL3 RW |UNK |64 Thread Pointer / ID Register, EL3 
4.2.9 AArch64 performance monitor registers 
The following table shows the performance monitor registers in AArch64 state. 
Table 4-10 AArch64 performance monitor registers 

Name Type | Reset Width | Description 

PMCR_ELO RW | 0x410430080 | 32 Performance Monitors Control Register 

PMCNTENSET ELO |RW | UNK 32 Performance Monitors Count Enable Set Register ” 

PMCNTENCLR EL0|RW | UNK 32 Performance Monitors Count Enable Clear Register” 

PMOVSCLR_ELO RW |UNK 32 Performance Monitors Overflow Flag Status Clear Register” 

PMSWINC ELO WO |- 32 Performance Monitors Software Increment Register” 

PMSELR_ELO RW |UNK 32 Performance Monitors Event Counter Selection Register ” 
PMCEIDO_ELO RO | @x7BFF7F3F | 32 11.4.2 Performance Monitors Common Event Identification Register 0 
on page 11-433 
PMCEID1_ ELO RO | 0x000000880 | 32 11.4.3 Performance Monitors Common Event Identification Register 1 

on page 11-436" 
PMCCNTR_ELO RW |UNK 64 Performance Monitors Cycle Counter” 
PMXEVTYPER ELO|RW_ | UNK 32 Performance Monitors Selected Event Type and Filter Register ” 
PMXEVCNTR_ELO |RW | UNK 32 Performance Monitors Selected Event Counter Register” 
PMUSERENR ELO |RW_ | 0x000000@O | 32 Performance Monitors User Enable Register ” 
PMINTENSET_EL1 |RW | UNK 32 Performance Monitors Interrupt Enable Set Register” 
PMINTENCLR ELI] |RW | UNK 32 Performance Monitors Interrupt Enable Clear Register ” 
PMOVSSET_ELO RW |UNK 32 Performance Monitors Overflow Flag Status Set Register ” 






































m RO at ELO. 
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Table 4-10 AArch64 performance monitor registers (continued) 










































































Name Type | Reset Width | Description 

PMEVCNTRO ELO |RW | UNK 32 Performance Monitor Event Count Registers 
PMEVCNTRI ELO |RW | UNK 32 

PMEVCNTR2 ELO |RW | UNK 32 

PMEVCNTR3 ELO |RW | UNK 32 

PMEVCNTR4 ELO |RW | UNK 32 

PMEVCNTRS ELO |RW | UNK 32 

PMEVTYPERO ELO |RW | UNK 32 Performance Monitor Event Type Registers 
PMEVTYPERI ELO |RW | UNK 32 

PMEVTYPER2 ELO |RW | UNK 32 

PMEVTYPER3 ELO |RW | UNK 32 

PMEVTYPER4 ELO |RW | UNK 32 

PMEVTYPERS ELO |RW | UNK 32 

PMCCFILTR_ELO RW | 0x000000880 | 32 Performance Monitors Cycle Count Filter Register” 









































4.2.10 AArch64 reset registers 
The following table shows the reset registers in AArch64 state. 
Table 4-11 AArch64 reset management registers 
Name Type | Reset Width | Description 
RVBAR_EL3|RO | -° 64 4.3.81 Reset Vector Base Address Register, EL3 on page 4-180 
RMR _ EL3 RW | 0x00800001? | 32 4.3.82 Reset Management Register on page 4-181 
4.2.11 AArch64 Secure registers 


The following table shows the Secure registers in AArch64 state. 


Table 4-12 AArch64 Secure registers 























Name Type | Reset Width | Description 

SCR_EL3 RW |@0x00000000 | 32 4.3.49 Secure Configuration Register on page 4-139 

SDER32_EL3 | RW_ | 0x000000@80 | 32 4.3.50 Secure Debug Enable Register on page 4-142 

CPTR_EL3 RW |@0x00000000 | 32 4.3.53 Architectural Feature Trap Register, EL3 on page 4-144 
MDCR_EL3 |RW | UNK 32 4.3.54 Monitor Debug Configuration Register, EL3 on page 4-145 
AFSRO_EL3 |RW_ | 0x000000080 | 32 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158 




















n See the ARM” Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for more information. 
O The reset value depends on the RVBARADDR signal. 
P This value depends on the AA64NAA32 pin value, which is Asserted in AArch64 state. 
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Table 4-12 AArch64 Secure registers (continued) 





Name 


Type | Reset 


Width | Description 





AFSR1_EL3 | RW 


0XxX00000000 | 32 


4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158 





































































































VBAR EL3 | RW | UNK 64 4.3.80 Vector Base Address Register, EL3 on page 4-180 
4.2.12 AArché64 virtualization registers 
The following table shows the virtualization registers in AArch64 state. 
Table 4-13 AArch64 virtualization registers 
Name Type | Reset Width | Description 
VPIDR_EL2 |RW_ | 0x410FD@91 | 32 4.3.35 Virtualization Processor ID Register on page 4-117 
VMPIDR_EL2/RW_ |-4 64 4.3.36 Virtualization Multiprocessor ID Register on page 4-117 
SCTLR_EL2 |RW |UNK 32 4.3.42 System Control Register, EL2 on page 4-125 
ACTLR_EL2 |RW_ | 0x000000@O | 32 4.3.39 Auxiliary Control Register, EL2 on page 4-121 
HCR_EL2 RW _ | 0x000000@2 | 64 4.3.43 Hypervisor Configuration Register on page 4-127 
MDCR_EL2 |RW_ | 0x000008@6 | 32 4.3.44 Hyp Debug Control Register on page 4-132 
CPTR_EL2 RW | 0x000033FF | 32 4.3.45 Architectural Feature Trap Register, EL2 on page 4-134 
HSTR_EL2 RW _ | 0x000000@80 | 32 4.3.46 Hyp System Trap Register on page 4-135 
HACR_EL2 RW |@x00000000 | 32 4.3.47 Hyp Auxiliary Configuration Register on page 4-137 
TTBRO EL2 |RW |UNK 64 Translation Table Base Address Register 0, EL2" 
TCR_EL2 RW |UNK 32 4.3.56 Translation Control Register, EL2 on page 4-150 
VTTBR_EL2 |RW | UNK 64 Virtualization Translation Table Base Address Register, EL2 " 
VTCR_EL2 RW |UNK 32 4.3.57 Virtualization Translation Control Register, EL2 on page 4-152 
DACR32_EL2 |RW | UNK 32 4.3.58 Domain Access Control Register on page 4-154 
AFSRO_EL2 |RW_ | 0x@00000@0 | 32 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158 
AFSR1_EL2 |RW_ | 0x00000008 | 32 4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158 
ESR_EL2 RW |UNK 32 4.3.66 Exception Syndrome Register, EL2 on page 4-163 
FAR_EL2 RW |UNK 64 4.3.69 Fault Address Register, EL2 on page 4-166 
HPFAR EL2 |RW |UNK 64 4.3.70 Hypervisor IPA Fault Address Register, EL2 on page 4-167 
MAIR EL2 RW |UNK 64 4.3.76 Memory Attribute Indirection Register, EL2 on page 4-177 
AMAIR EL2 |RW_ | 0x0@00008@8 | 64 4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 
on page 4-158 
VBAR_EL2 RW |UNK 64 4.3.79 Vector Base Address Register, EL2 on page 4-179 


























q The reset value is the value of the Multiprocessor Affinity Register. 
T See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for more information. 
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4.2.13 AArch64 EL2 TLB maintenance operations 
The following table shows the System instructions for TLB maintenance operations added in AArch64 
state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for more 
information about these operations. 
Table 4-14 AArch64 TLB maintenance operations 
Name Description 
TLBI IPAS2E1IS Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID, Inner Shareable 
TLBI IPAS2LE1IS Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID, Inner Shareable 
TLBI ALLE2IS Invalidate all stage 1 translations used at EL2, Inner Shareable 
TLBI VAE2IS Invalidate translation used at EL2 for the specified VA and ASID and the current VMID, Inner Shareable 
TLBI ALLE11IS Invalidate all stage 1 translations used at EL1, Inner Shareable 
TLBI VALE2IS Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID, Inner Shareable 
TLBI VMALLS12E1TS | Invalidate all stage 1 and 2 translations used at EL1 with the current VMID, Inner Shareable 
TLBI IPAS2E1 Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID 
TLBI IPAS2LE1 Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID 
TLBI ALLE2 Invalidate all stage 1 translations used at EL2 
TLBI VAE2 Invalidate translation used at EL2 for the specified VA and ASID and the current VMID 
TLBI ALLE1 Invalidate all stage 1 translations used at EL1 
TLBI VALE2 Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID 
TLBI VMALLS12E1 Invalidate all stage 1 and 2 translations used at EL1 with the current VMID 
TLBI ALLE3IS Invalidate all stage 1 translations used at EL3, Inner Shareable 
TLBI VAE3IS Invalidate translation used at EL3 for the specified VA and ASID and the current VMID, Inner Shareable 
TLBI VALE3IS Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID, Inner Shareable 
TLBI ALLE3 Invalidate all stage 1 translations used at EL3 
TLBI VAE3 Invalidate translation used at EL3 for the specified VA and ASID and the current VMID 
TLBI VALE3 Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID 
4.2.14 AArch64 GIC system registers 
The following table shows the GIC system registers in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
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Table 4-15 GIC system registers 














































































































Name Type | Reset Width | Description 

ICC_APORO EL1 RW | 0xeeee00000 32 Active Priorities 0 Register 0 

ICC_AP1RO_ EL1 RW | 8xeee00000 32 Active Priorities 1 Register 0 

ICC_ASGIIR_EL1 | WO |- 64 Alternate SGI Generation Register 1 

ICC_BPRO EL1 RW |@0x00000002 32 Binary Point Register 0 

ICC_BPR1_EL1 RW |@0x00000003" 32 Binary Point Register 1 

ICC_CTLR_EL1 RW |@0x00000400 32 Interrupt Control Register for EL1 

ICC_CTLR_EL3 RW | 0xeee00400 32 Interrupt Control Register for EL3 

ICC_DIR_EL1 WO |- 32 Deactivate Interrupt Register 

ICC_EOIRO_EL1 WO |- 32 End Of Interrupt Register 0 

ICC_EOIR1_EL1 WO |- 32 End Of Interrupt Register 1 

ICC_HPPIRO ELI |RO |- 32 Highest Priority Pending Interrupt Register 0 
ICC_HPPIR1 ELI |RO |- 32 Highest Priority Pending Interrupt Register 1 
ICC_IARO ELI RO |l- 32 Interrupt Acknowledge Register 0 

ICC_IAR1I_EL1 RO |- 32 Interrupt Acknowledge Register 1 

ICC_IGRPENO_ ELI |RW |@0x00000000 32 Interrupt Group Enable Register 0 

ICC_IGRPEN1 EL1|RW_ |@0x00000000 32 Interrupt Group Enable Register 1 

ICC_IGRPEN1 EL3|RW_ |@0x00000000 32 Interrupt Group Enable Register 1 for EL3 
ICC_PMR_EL1 RW | 0xeeee00000 32 Priority Mask Register 

ICC_RPR_EL1 RO |- 32 Running Priority Register 

ICC_SGIOR_EL1 WO |- 64 SGI Generation Register 0 

ICC_SGIIR ELI WO |- 64 SGI Generation Register 1 

ICC_SRE_EL1 RW |@0x00000000 32 System Register Enable Register for EL1 
ICC_SRE_EL2 RW |@0x00000000 32 System Register Enable Register for EL2 
ICC_SRE_EL3 RW |@0x00000000 32 System Register Enable Register for EL3 
ICH_APORO_EL2 RW |@0x00000000 32 Interrupt Controller Hyp Active Priorities Register (0,0) 
ICH_AP1RO_EL2 RW |@0x00000000 32 Interrupt Controller Hyp Active Priorities Register (1,0) 
ICH_EISR_EL2 RO |@0x00000000 32 Interrupt Controller End of Interrupt Status Register 
ICH ELRSR EL2 |RO |@0x0000000F 32 Interrupt Controller Empty List Register Status Register 
ICH_HCR_EL2 RW |@0x00000000 32 Interrupt Controller Hyp Control Register 

ICH_LRO EL2 RW | 0x@0000088 80000000 | 64 Interrupt Controller List Register 0 

ICH_LR1_EL2 RW | 0x@e0000088 80000000 | 64 Interrupt Controller List Register 1 

ICH_LR2 EL2 RW | 0x@e0000080 800000080 | 64 Interrupt Controller List Register 2 

ICH_LR3_EL2 RW | 0x@0000080 80000000 | 64 Interrupt Controller List Register 3 

ICH_MISR_EL2 RO |@0x00000000 32 Interrupt Controller Maintenance Interrupt State Register 























S 


This is the reset value in Non-secure states. In Secure states, the reset value is 0x00000002. 
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Table 4-15 GIC system registers (continued) 





Name 


Type 


Reset 


Width | Description 





ICH_VMCR_EL2 


RW 


0x004C0000 


32 Interrupt Controller Virtual Machine Control Register 








ICH_VTR_EL2 





RO 





0x90000003 


32 Interrupt Controller VGIC Type Register 














4.2.15 


AArch64 Generic Timer registers 


See 9.2 Generic Timer functional description on page 9-374 for information on the Generic Timer 


registers. 


4.2.16 


AArch64 thread registers 


4.2.17 


The following table shows the thread registers in AArch64 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 


Table 4-16 AArch64 miscellaneous system control operations 





Name 


Reset | Width | Description 


Type 





TPIDR_ELO 


RW |UNK | 64 Thread Pointer/ID Register, ELO 





TPIDR_ EL1 


RW 64 Thread Pointer/ID Register, EL1 





TPIDRRO ELO 


RW 64 Thread Pointer/ID Register, Read-Only, ELO 





TPIDR_EL2 


RW 64 Thread Pointer/ID Register, EL2 








TPIDR_ EL3 











E E LEGE- 
ALA ALA 


RW 64 Thread Pointer/ID Register, EL3 




















AArch64 implementation defined registers 


The following table shows the IMPLEMENTATION DEFINED registers in AArch64 state. 


These registers provide test features and any required configuration options specific to the Cortex-A73 
processor. If a register is not indicated as mapped to an AArch32 64-bit register, bits[63:32] are 
0x00000000. 


Table 4-17 AArch64 IMPLEMENTATION DEFINED registers 





Name 


Type 


Reset 


Width 


Description 





L2CTLR_EL1 


RW 


32 


4.3.71 L2 Control Register on page 4-168 





L2ECTLR_EL1 


RW 


0x00000000 


32 


4.3.72 L2 Extended Control Register on page 4-171 





ECTLR_EL1" 


RW 


0x00000000 
00000580 


64 


4.3.84 Extended Control Register, EL1 on page 4-183 





L2MERRSR_EL1" 


RW 


0x00000000 


64 


4.3.85 L2 Memory Error Syndrome Register on page 4-185 





CBAR_EL1 


RO 


Vv 


64 


4.3.86 Configuration Base Address Register, ELI on page 4-186 





CDBGDRO_EL3 


RO 


UNK 


32 


Direct access to internal memory, Data Register 0, see 6.7 Direct access to 
internal memory on page 6-337. 








CDBGDR1_EL3 


RO 








UNK 


32 





Direct access to internal memory, Data Register 1, see 6.7 Direct access to 





internal memory on page 6-337. 








t The reset value depends on the processor implementation and the s 


u Mapped to a 64-bit AArch32 register. 
V The reset value depends on the PERIPHBASE signal. 





ate of the LARSTDISABLE signal. 
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Table 4-17 AArch64 IMPLEMENTATION DEFINED registers (continued) 




















Name Type | Reset Width | Description 

CDBGDR2 EL3 |RO |UNK 32 Direct access to internal memory, Data Register 2, see 6.7 Direct access to 
internal memory on page 6-337. 

CDBGDR3_ EL3 |RO |UNK 32 Direct access to internal memory, Data Register 3, see 6.7 Direct access to 
internal memory on page 6-337. 














4.2.18 AArch64 implementation defined operations 


The following table shows the implementation defined operations in AArch64 state. 


Table 4-18 AArch64 implementation defined maintenance operations 






























































Name Type | Reset | Width | Description 

DC CIALL WO |UNK [|32 Clean/invalidate all data or unified caches, see 4.3.87 DC CIALL Clean Invalidate All 
on page 4-187. 

CDBGDCT_EL3 | WO |UNK_ | 32 Data Cache Tag Read Operation Register, see 6.7 Direct access to internal memory 
on page 6-337. 

CDBGICT_EL3 | WO |UNK | 32 Instruction Cache Tag Read Operation Register, see 6.7 Direct access to internal memory 
on page 6-337. 

CDBGDCD_EL3|}WO |UNK_ | 32 Data Cache Data Read Operation Register, see 6.7 Direct access to internal memory 
on page 6-337. 

CDBGICD_EL3 |WO |UNK _ | 32 Instruction Cache Data Read Operation Register, see 6.7 Direct access to internal memory 
on page 6-337. 

CDBGTD_EL3 | WO |UNK | 32 TLB Data Read Operation Register, see 6.7 Direct access to internal memory 
on page 6-337. 
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4.3 AArch64 register descriptions 


This section describes all the system registers, in register number order, when the system is in the 
AArch64 Execution state. 


See 4.2.1 AArch64 identification registers on page 4-66, which provides cross-references to individual 
registers. 


This section contains the following subsections: 

e 4.3.1 Main ID Register, ELI on page 4-81. 

e 4.3.2 Multiprocessor Affinity Register on page 4-82. 

e 4.3.3 Revision ID Register on page 4-84. 

e 4.3.4 AArch32 Processor Feature Register 0 on page 4-85. 

e 4.3.5 AArch32 Processor Feature Register 1 on page 4-86. 

e 4.3.6 AArch32 Debug Feature Register 0 on page 4-87. 

e 4.3.7 AArch32 Auxiliary Feature Register 0 on page 4-88. 

e 4.3.8 AArch32 Memory Model Feature Register 0 on page 4-88. 

e 4.3.9 AArch32 Memory Model Feature Register 1 on page 4-90. 

e 4.3.10 AArch32 Memory Model Feature Register 2 on page 4-91. 

e 4.3.11 AArch32 Memory Model Feature Register 3 on page 4-93. 

e 4.3.12 AArch32 Instruction Set Attribute Register 0 on page 4-94. 
e 4.3.13 AArch32 Instruction Set Attribute Register I on page 4-95. 
e 4.3.14 AArch32 Instruction Set Attribute Register 2 on page 4-97. 
e 4.3.15 AArch32 Instruction Set Attribute Register 3 on page 4-99. 
e 4.3.16 AArch32 Instruction Set Attribute Register 4 on page 4-100. 
e 4.3.17 AArch32 Instruction Set Attribute Register 5 on page 4-101. 
e 4.3.18 AArch32 Memory Model Feature Register 4 on page 4-103. 
e 4.3.19 AArch64 Processor Feature Register 0 on page 4-104. 

e 4.3.20 AArch64 Processor Feature Register 1 on page 4-105. 

e 4.3.21 AArch64 Debug Feature Register 0, ELI on page 4-106. 

e 4.3.22 AArch64 Debug Feature Register 1 on page 4-107. 

e 4.3.23 AArch64 Auxiliary Feature Register 0 on page 4-107. 

e 4.3.24 AArch64 Auxiliary Feature Register I on page 4-107. 

e 4.3.25 AArch64 Instruction Set Attribute Register 0, ELI on page 4-107. 
e 4.3.26 AArch64 Instruction Set Attribute Register 1, ELI on page 4-109. 
e 4.3.27 AArch64 Memory Model Feature Register 0, ELI on page 4-109. 
e 4.3.28 AArch64 Memory Model Feature Register 1 on page 4-110. 
e 4.3.29 Cache Size ID Register on page 4-110. 

e 4.3.30 Cache Level ID Register on page 4-112. 

e 4.3.31 Auxiliary ID Register on page 4-113. 

e 4.3.32 Cache Size Selection Register on page 4-113. 

e 4.3.33 Cache Type Register on page 4-115. 

¢ 4.3.34 Data Cache Zero ID Register on page 4-116. 

e 4.3.35 Virtualization Processor ID Register on page 4-117. 

e 4.3.36 Virtualization Multiprocessor ID Register on page 4-117. 

e 4.3.37 System Control Register, ELI on page 4-118. 

e 4.3.38 Auxiliary Control Register, ELI on page 4-121. 

e 4.3.39 Auxiliary Control Register, EL2 on page 4-121. 

¢ 4.3.40 Auxiliary Control Register, EL3 on page 4-123. 

e 4.3.41 Architectural Feature Access Control Register on page 4-124. 
e 4.3.42 System Control Register, EL2 on page 4-125. 

e 4.3.43 Hypervisor Configuration Register on page 4-127. 

¢ 4.3.44 Hyp Debug Control Register on page 4-132. 

e 4.3.45 Architectural Feature Trap Register, EL2 on page 4-134. 

¢ 4.3.46 Hyp System Trap Register on page 4-135. 

e 4.3.47 Hyp Auxiliary Configuration Register on page 4-137. 
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¢ 4.3.48 System Control Register, EL3 on page 4-138. 

e 4.3.49 Secure Configuration Register on page 4-139. 

e 4.3.50 Secure Debug Enable Register on page 4-142. 

e 4.3.51 Translation Table Base Register 0, ELI on page 4-142. 

¢ 4.3.52 Translation Table Base Register 1 on page 4-143. 

e 4.3.53 Architectural Feature Trap Register, EL3 on page 4-144. 

¢ 4.3.54 Monitor Debug Configuration Register, EL3 on page 4-145. 

e 4.3.55 Translation Control Register, ELI on page 4-147. 

¢ 4.3.56 Translation Control Register, EL2 on page 4-150. 

e 4.3.57 Virtualization Translation Control Register, EL2 on page 4-152. 
¢ 4.3.58 Domain Access Control Register on page 4-154. 

e 4.3.59 Translation Table Base Register 0, EL3 on page 4-155. 

¢ 4.3.60 Translation Control Register, EL3 on page 4-156. 

¢ 4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 on page 4-158. 
e 4.3.62 Auxiliary Fault Status Register 0, ELI, EL2 and EL3 on page 4-158. 
e 4.3.63 Auxiliary Fault Status Register 1, ELI, EL2 and EL3 on page 4-158. 
e 4.3.64 Exception Syndrome Register, EL1 on page 4-158. 

e 4.3.65 Instruction Fault Status Register, EL2 on page 4-159. 

e 4.3.66 Exception Syndrome Register, EL2 on page 4-163. 

e 4.3.67 Exception Syndrome Register, EL3 on page 4-164. 

¢ 4.3.68 Fault Address Register, ELI on page 4-165. 

e 4.3.69 Fault Address Register, EL2 on page 4-166. 

¢ 4.3.70 Hypervisor IPA Fault Address Register, EL2 on page 4-167. 

e 4.3.71 L2 Control Register on page 4-168. 

e 4.3.72 L2 Extended Control Register on page 4-171. 

e 4.3.73 Fault Address Register, EL3 on page 4-172. 

e 4.3.74 Physical Address Register, ELI on page 4-173. 

© 4.3.75 Memory Attribute Indirection Register, EL] on page 4-175. 

e 4.3.76 Memory Attribute Indirection Register, EL2 on page 4-177. 

e 4.3.77 Memory Attribute Indirection Register, EL3 on page 4-177. 

e 4.3.78 Vector Base Address Register, ELI on page 4-178. 

e 4.3.79 Vector Base Address Register, EL2 on page 4-179. 

e 4.3.80 Vector Base Address Register, EL3 on page 4-180. 

¢ 4.3.81 Reset Vector Base Address Register, EL3 on page 4-180. 

e 4.3.82 Reset Management Register on page 4-181. 

e 4.3.83 Interrupt Status Register on page 4-182. 

¢ 4.3.84 Extended Control Register, ELI on page 4-183. 

e 4.3.85 L2 Memory Error Syndrome Register on page 4-185. 

e 4.3.86 Configuration Base Address Register, ELI on page 4-186. 

e 4.3.87 DC CIALL Clean Invalidate All on page 4-187. 


4.3.1 Main ID Register, EL1 
The MIDR_ ELI characteristics are: 


Purpose Provides identification information for the processor, including an implementer code 
for the device and a device ID number. 


Usage constraints This register is accessible as follows: 
































ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO |RO |RO RO 
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Configurations The MIDR_ ELl! is: 
e Architecturally mapped to the AArch32 MIDR register. See 4.5.7 Main ID 
Register on page 4-214. 
e Architecturally mapped to external MIDR_ EL] register. 


Attributes MIDR_ ELI is a 32-bit register. 


The following figure shows the MIDR_EL1 bit assignments. 


31 24 23 20 19 1615 4 3 0 


Figure 4-1 MIDR_EL1 bit assignments 
The following table shows the MIDR_EL1 bit assignments. 


Table 4-19 MIDR_EL1 bit assignments 





Bits 


Name 


Function 





[31:24] 


Implementer | Indicates the implementer code. This value is: 


0x41 ASCII character 'A' - implementer is ARM. 





[23:20] 


Variant 


Indicates the variant number of the processor. This is the major revision number x in the rx part of the rxpy 
description of the product revision status. This value is: 


0x r0p2. 





[19:16] 


Architecture | Indicates the architecture code. This value is: 


OxF Defined by CPUID scheme. 





[15:4] 


PartNum 


Indicates the primary part number. This value is: 


@xD@9 = Cortex-A73 processor. 





[3:0] 








Revision 


Indicates the minor revision number of the processor. This is the minor revision number y in the py part of the 
rxpy description of the product revision status. This value is: 


0x2 r0p2. 











4.3.2 


To access the MIDR_ELI: 


MRS <Xt>, MIDR_EL1 ; Read MIDR_EL1 into Xt 
The following table shows the register access encoding: 


Table 4-20 MIDR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0000 | 000 




















The MIDR_ELI can be accessed through the memory-mapped interface and the external debug interface, 
offset @xDee. 


Multiprocessor Affinity Register 


The MPIDR_ ELI characteristics are: 
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Purpose Provides an additional core identification mechanism for scheduling purposes in a 
cluster system. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations The MPIDR_EL1[31:0] is: 
e Architecturally mapped to the AArch32 MPIDR register. See 
4.5.2 Multiprocessor Affinity Register on page 4-215. 
e Mapped to external EDDEVAFFO register. 


MPIDR_EL1[63:32] is mapped to external EDDEVAFF 1 register. 
Attributes MPIDR_ EL] is a 64-bit register. 


The following figure shows the MPIDR_EL1 bit assignments. 


40 39 32.31 30 29 25 24 23 


[= A 


LRes1 


Figure 4-2 MPIDR_EL1 bit assignments 
The following table shows the MPIDR_ELI bit assignments. 


Table 4-21 MPIDR_EL1 bit assignments 












































Bits Name Function 

[63:40] - Reserved, RESO. 

[39:32] Aff3 Affinity level 3. Highest level affinity field. 
Reserved, RESO. 

[31] - Reserved, RES1. 

[30] U Processor is part of a multiprocessor 
system. 

[29:25] - Reserved, RESO. 

[24] MT Indicates whether the lowest level of 
affinity consists of logical cores that are 
implemented using a multi-threading type 
approach. This value is: 
© Performance of cores at the lowest 

affinity level is largely independent. 

[23:16] Aff2 Affinity level 2. Second highest level 
affinity field. 

Indicates the value read in the 
CLUSTERIDAFF? configuration signal. 
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Table 4-21 MPIDR_EL1 bit assignments (continued) 
















































































Bits Name Function 
[15:8] Affl Affinity level 1. Third highest level affinity 
field. 
Indicates the value read in the 
CLUSTERIDAFF1 configuration signal. 
[7:0] Aff0 Affinity level 0. Lowest level affinity field. 
Indicates the core number in the Cortex- 
A73 processor. The possible values are: 
@x® A cluster with one core 
only. 
0x0, 0x1 A cluster with two cores. 
0x0, 0x1, A cluster with three cores. 
0x2 
0x0, 0x1, A cluster with four cores. 
0x2, 0x3 
To access the MPIDR_ELI: 
MRS <Xt>, MPIDR_EL1 ; Read MPIDR_EL1 into Xt 
Register access is encoded as follows: 
Table 4-22 MPIDR_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 000 |0000 | 0000 |101 
The EDDEVAFFO and EDDEVAFF! can be accessed through the external debug interface, offsets @xFA8 
and @xFAC respectively. 
4.3.3 Revision ID Register 
The REVIDR_EL]1 characteristics are: 
Purpose Provides implementation-specific minor revision information that can be interpreted 
only in conjunction with the Main ID Register. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO |RO |RO RO 
Configurations © REVIDR_EL1 is architecturally mapped to AArch32 register REVIDR. See 
4.5.3 Revision ID Register on page 4-217. 
Attributes REVIDR_ELI is a 32-bit register. 
The following figure shows the REVIDR_ EL] bit assignments. 
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31 0 


Figure 4-3 REVIDR_EL1 bit assignments 
The following table shows the REVIDR_EL1 bit assignments. 


Table 4-23 REVIDR_EL1 bit assignments 


Bits | Name Function 





[31:0] | ID number | Implementation-specific revision information. The reset value is determined by the specific Cortex-A73 processor 


= 


implementation. 


0x00000000 Revision code is zero. 














To access the REVIDR_EL1: 


MRS <Xt>, REVIDR_EL1 ; Read REVIDR_EL1 into Xt 
Register access is encoded as follows: 


Table 4-24 REVIDR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0000 | 110 


























4.3.4 AArch32 Processor Feature Register 0 
The ID_PFRO_ ELI characteristics are: 
Purpose Gives top-level information about the instruction sets supported by the processor in 
AArch32. 

Usage constraints This register is accessible as follows: 

ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 

- RO |RO [RO |RO RO 























Configurations [ID PFRO EL] is architecturally mapped to AArch32 register ID_PFRO. See 
4.5.6 Processor Feature Register 0 on page 4-218. 


Attributes ID_PFRO_ ELI is a 32-bit register. 


The following figure shows the ID_PFRO_EL1 bit assignments. 
31 16 15 12 11 8 


7 4 3 0 


Figure 4-4 ID_PFRO_EL1 bit assignments 


The following table shows the ID_PFRO_ EL! bit assignments. 
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Table 4-25 ID_PFRO_EL1 bit assignments 

























































































Bits |Name | Function 
[31:16] | - Reserved, RESO. 
[15:12] | State3 | Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 
0x0 Processor does not support the T32EE instruction set. 
[11:8] | State2 | Indicates support for Jazelle. This value is: 
0x1 Processor supports trivial implementation of Jazelle. 
[7:4] Statel | Indicates support for T32 instruction set. This value is: 
0x3 Processor supports T32 encoding after the introduction of Thumb-2 technology, and for all 16-bit and 32- 
bit T32 basic instructions. 
[3:0] State0 | Indicates support for A32 instruction set. This value is: 
@x1 A32 instruction set implemented. 
To access the ID_PFRO ELI: 
MRS <Xt>, ID_PFR@_EL1 ; Read ID_PFR@_EL1 into Xt 
Register access is encoded as follows: 
Table 4-26 ID_PFRO_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 000 | 0000 | 0001 | 000 
4.3.5 AArch32 Processor Feature Register 1 
The ID_PFR1 ELI characteristics are: 
Purpose Provides information about the programmers model and architecture extensions 
supported by the processor. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations [ID PFRI1 ELI is architecturally mapped to AArch32 register ID_PFR1. See 
4.5.7 Processor Feature Register 1 on page 4-219. 
Attributes ID_PFRI ELI is a 32-bit register. 
The following figure shows the ID_PFR1_EL1 bit assignments. 
31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 
[osou] ewnes  |cemmer| rant] secui | oats 
Virtualization 
Figure 4-5 ID_PFR1_EL1 bit assignments 
The following table shows the ID_PFR1_ EL! bit assignments. 
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Table 4-27 ID_PFR1_EL1 bit assignments 































































































Bits |Name Function 
[31:28] | GIC CPU GIC CPU support: 
0x0 GIC CPU interface is disabled, GICCDISABLE is HIGH. 
@x1 GIC CPU interface is enabled. 
[27:20] | - Reserved, RESO. 
[19:16] | GenTimer Generic Timer support: 
@x1 Generic Timer supported. 
[15:12] | Virtualization | Virtualization support: 
0x1 Virtualization is implemented. 
[11:8] | MProgMod |M profile programmers model support: 
0x0 Not supported. 
[7:4] Security Security support: 
0x1 Security implemented. This includes support for Monitor mode and the SMC instruction. 
[3:0] | ProgMod Indicates support for the standard programmers model for ARMv4 and later. 
Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined, and System modes: 
0x1 Supported. 
To access the ID_PFR1_EL1: 
MRS <Xt>, ID_PFR1_EL1 ; Read ID_PFR1_EL1 into Xt 
Register access is encoded as follows: 
Table 4-28 ID_PFR1_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 |000 |0000 |0001 |001 
4.3.6 AArch32 Debug Feature Register 0 
The ID_DFRO ELI characteristics are: 
Purpose Provides top level information about the debug system in AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations [D DFRO ELI is architecturally mapped to AArch32 register ID_DFRO. See 
4.5.8 Debug Feature Register 0 on page 4-220. 
Attributes ID_DFRO_EL] is a 32-bit register. 
The following figure shows the ID_DFRO ELI bit assignments. 
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MProfDbg | MMapTrc MMapDbg | CopSDbg | CopDbg 


Figure 4-6 ID_DFRO_EL1 bit assignments 
The following table shows the ID_DFRO_EL! bit assignments. 


Table 4-29 ID_DFRO_EL1 bit assignments 







































































Bits /Name Function 
[31:28] | - Reserved, RESO. 
[27:24] | PerfMon | Indicates support for performance monitor model: 
0x3 Support for Performance Monitor Unit version 3 (PMUv3) system registers. 
[23:20] | MProfDbg | Indicates support for memory-mapped debug model for M profile processors: 
0x0 Processor does not support M profile Debug architecture. 
[19:16] | MMapTrc | Indicates support for memory-mapped trace model: 
0x1 Support for ARM trace architecture, with memory-mapped access. 
In the Trace registers, the ETMIDR register gives more information about the implementation. 
[15:12] | CopTre Indicates support for coprocessor-based trace model: 
0x0 Processor does not support ARM trace architecture with CP14 access. 
[11:8] | MMapDbg | Reserved, RESO. 
[7:4] CopSDbg | Indicates support for coprocessor-based Secure debug model: 
@x6 Processor supports v8 Debug architecture, with CP 14 access. 
[3:0] CopDbg Indicates support for coprocessor-based debug model: 
@x6 Processor supports v8 Debug architecture, with CP 14 access. 
To access the ID DFRO_ ELI: 
MRS <Xt>, ID DFR@_EL1 ; Read ID_DFR@ EL1 into Xt 
Register access is encoded as follows: 
Table 4-30 ID_DFRO_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0001 | 010 
4.3.7 AArch32 Auxiliary Feature Register 0 
This register is always RESO. 
4.3.8 AArch32 Memory Model Feature Register 0 
The ID MMFRO _ ELI characteristics are: 
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Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations ID MMFRO EL] is architecturally mapped to AArch32 register ID_ MMFRO. See 
4.5.10 Memory Model Feature Register 0 on page 4-221. 


Attributes ID_MMFRO ELI is a 32-bit register. 


The following figure shows the ID MMFRO_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Fose Aaroa | Tom Sharelvi | Outershr | pasa | VMSA 


Figure 4-7 ID_MMFRO0_EL1 bit assignments 
The following table shows the ID MMFRO_ ELI bit assignments. 


Table 4-31 ID_MMFRO_EL1 bit assignments 
























































Bits |Name_ | Function 
[31:28] | InnerShr | Indicates the innermost shareability domain implemented: 
0x1 Implemented with hardware coherency support. 
[27:24] | FCSE Indicates support for Fast Context Switch Extension (FCSE): 
@x® Not supported. 
[23:20] | AuxReg | Indicates support for Auxiliary registers: 
0x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary Control Register. 
[19:16] | TCM Indicates support for TCMs and associated DMAs: 
@x® Not supported. 
[15:12] | ShareLvl | Indicates the number of shareability levels implemented: 
@x1 Two levels of shareability implemented. 
[11:8] | OuterShr | Indicates the outermost shareability domain implemented: 
0x1 Implemented with hardware coherency support. 
[7:4] |PMSA |Indicates support for a Protected Memory System Architecture (PMSA): 
@x® Not supported. 
[3:0] | VMSA __ | Indicates support for a Virtual Memory System Architecture (VMSA). 
0x5 Support for: 
e VMSAv7, with support for remapping and the Access flag. 
¢ The PXN bit in the Short-descriptor translation table format descriptors. 
¢ The Long-descriptor translation table format. 
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To access the ID MMFRO ELI: 


MRS <Xt>, ID_MMFR@_EL1 ; Read ID_MMFR@_EL1 into Xt 


Register access is encoded as follows: 


Table 4-32 ID_MMFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 

















11 | 000 | 0000 | 0001 | 100 
















































































4.3.9 AArch32 Memory Model Feature Register 1 
The ID MMFRI ELI characteristics are: 
Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations [ID MMFRI1 ELI is architecturally mapped to AArch32 register ID MMFRI. See 
4.5.11 Memory Model Feature Register 1 on page 4-223. 
Attributes ID_MMEFRI1 ELI is a 32-bit register. 
The following figure shows the ID MMFR1_ EL] bit assignments. 
28 27 24 23 20 19 16 15 12 11 
L1TstClin LiHvd L1UniSW | LiHvdSW | L1UniVA | LiHvdVA 
Figure 4-8 ID_MMFR1_EL1 bit assignments 
The following table shows the ID MMFR1_ EL! bit assignments. 
Table 4-33 ID_MMFR1_EL1 bit assignments 
Bits |Name Function 
[31:28] | BPred Indicates branch predictor management requirements: 
0x4 For execution correctness, branch predictor requires no flushing at any time. 
[27:24] | L1TstCln | Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache implementation: 
@x® None supported. 
[23:20] | L1Uni Indicates the supported entire L1 cache maintenance operations, for a unified cache implementation: 
@x® None supported. 
[19:16] | LiHvd Indicates the supported entire L1 cache maintenance operations, for a Harvard cache implementation: 
@x@ None supported. 
[15:12] | L1UniSW | Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache implementation: 
@x® None supported. 
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Table 4-33 ID_MMFR1_EL1 bit assignments (continued) 





Bits Name Function 





[11:8] | L1HvdSW | Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache implementation: 


@x® None supported. 





[7:4] | L1UniVA_ | Indicates the supported L1 cache line maintenance operations by MVA, for a unified cache implementation: 


@x® None supported. 





[3:0] | L1HvdVA | Indicates the supported L1 cache line maintenance operations by MVA, for a Harvard cache implementation: 


0x0 None supported. 

















To access the ID_MMFR1_EL1: 


MRS <Xt>, ID_MMFR1_EL1 ; Read ID_MMFR1_EL1 into Xt 
Register access is encoded as follows: 


Table 4-34 ID_MMFR1_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 |0001 | 101 




















4.3.10 AArch32 Memory Model Feature Register 2 
The ID MMFR2_ ELI characteristics are: 


Purpose Provides information about the implemented memory model and memory 
management support in AArch32. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations [ID MMFR2 EL] is architecturally mapped to AArch32 register ID_ MMFR2. See 
4.5.12 Memory Model Feature Register 2 on page 4-224. 


Attributes ID_MMFR2 ELI is a 32-bit register. 


The following figure shows the ID MMFR2_ EL] bit assignments. 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure 4-9 ID_MMFR2_EL1 bit assignments 
The following table shows the ID MMFR2_ EL! bit assignments. 
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Table 4-35 ID_MMFR2_EL1 bit assignments 















































Bits |Name Function 
[31:28] | HWAccFlg | Hardware access flag. Indicates support for a hardware access flag, as part of the VMSAv7 implementation: 
0x0 Not supported. 
[27:24] | WFIStall Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFT) stalling: 
0x1 Support for WFI stalling. 
[23:20] | MemBarr Memory Barrier. Indicates the supported CP15 memory barrier operations. 
0x2 Supported CP15 memory barrier operations are: 
e Data Synchronization Barrier (DSB). 
¢ Instruction Synchronization Barrier (ISB). 
¢ Data Memory Barrier (DMB). 
[19:16] | UniTLB Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB implementation. 
0x6 Supported unified TLB maintenance operations are: 
e Invalidate all entries in the TLB. 
e Invalidate TLB entry by MVA. 
¢  Inyalidate TLB entries by ASID match. 
e Invalidate instruction TLB and data TLB entries by MVA All ASID. This is a shared unified 
TLB operation. 
e Invalidate Hyp mode unified TLB entry by MVA. 
e Invalidate entire Non-secure EL1 and ELO unified TLB. 
e Invalidate entire Hyp mode unified TLB. 
e TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 
e TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 
[15:12] | HvdTLB Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB implementation: 
0x0 Not supported. 
[11:8] | LL1HvdRng | L1 Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a Harvard cache 
implementation: 
0x0 Not supported. 
[7:4] L1HvdBG |L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch operations, for a 
Harvard cache implementation: 
0x0 Not supported. 
[3:0] L1HvdFG L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch operations, for a 
Harvard cache implementation: 
0x0 Not supported. 
To access the ID MMFR2 ELI: 
MRS <Xt>, ID_MMFR2_EL1 ; Read ID_MMFR2_EL1 into Xt 
Register access is encoded as follows: 
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Table 4-36 ID_MMFR2_EL1 access encodi 


ons 


ng 





op0 | op1 | CRn | CRm | op2 





11 | 000 |0000 |0001 | 11 














0 








AArch32 Memory Model Feature Register 3 
The ID MMFR3_ ELI characteristics are: 


Purpose 


AArch32. 


Usage constraints This register is accessible as follows: 


Configurations 


Provides information about the memory model and memory management support in 





ELO | EL1 | EL1 | EL2 | EL3 EL3 


(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- RO |RO |RO |RO RO 























4.5.13 Memory Model Feature Register 3 on page 4-226. 


Attributes ID_MMFR3_ ELI is a 32-bit register. 


The following figure shows the ID MMFR3_ ELI bit assignments. 


28 27 24 23 20 19 1615 12 11 


CohWalk MaintBcst | BPMaint | CMaintSW | CMaintVA 


ID_MMFR3_ ELI is architecturally mapped to AArch32 register ID_ MMFR3. See 





Figure 4-10 ID_MMFR3_EL1 bit assignments 


The following table shows the ID MMFR3_ EL! bit assignments. 


Table 4-37 ID_MMFR3_EL1 bit assignments 





Bits 


Name 


Function 





[31:28] 


Supersec 


Supersections. Indicates support for supersections: 


@x® Supersections supported. 





[27:24] 


CMemSz 


Cached memory size. Indicates the size of physical memory supported by the processor caches: 


0x2 1TB, corresponding to a 40-bit physical address range. 








[23:20] 


CohWalk 


Coherent walk. Indicates whether translation table updates require a clean to the point of unification: 


0x1 Updates to the translation tables do not require a clean to the point of unification to ensure visibility 
by subsequent translation table walks. 





[19:16] 


Reserved, RESO. 





[15:12] 








MaintBest 





Maintenance broadcast. Indicates whether cache, TLB and branch predictor operations are broadcast: 


0x2 Cache, TLB and branch predictor operations affect structures according to shareability and defined 
behavior of instructions. 
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Table 4-37 ID_MMFR3_EL1 bit assignments (continued) 





Bits Name Function 





[11:8] | BPMaint | Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 


0x2 Supported branch predictor maintenance operations are: 


¢  Inyalidate all branch predictors. 
e Invalidate branch predictors by MVA. 





[7:4] | CMaintS W | Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/way. 


@x1 Supported hierarchical cache maintenance operations by set/way are: 
« Invalidate data cache by set/way. 
e Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 





[3:0] | CMaintVA | Cache maintenance by MVA. Indicates the supported cache maintenance operations by MVA. 


@x1 Supported hierarchical cache maintenance operations by MVA are: 
e Invalidate data cache by MVA. 


Invalidate data cache by MVA operations are treated as clean and invalidate data cache by MVA 
operations on the executing core. If the operation is broadcast to another core then it is broadcast 
as an invalidate data cache by MVA operation. 

e Clean data cache by MVA. 

e Clean and invalidate data cache by MVA. 

e Invalidate instruction cache by MVA. 

e  Invalidate all instruction cache entries. 

















To access the ID MMFR3_ ELI: 


MRS <Xt>, ID_MMFR3_EL1 ; Read ID_MMFR3_EL1 into Xt 


Register access is encoded as follows: 


Table 4-38 ID_MMFR3_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 |0000 |0001 | 111 




















4.3.12 AArch32 Instruction Set Attribute Register 0 
The ID ISARO_EL1 characteristics are: 


Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations ID ISARO ELI is architecturally mapped to AArch32 register ID ISARO. See 
4.5.14 Instruction Set Attribute Register 0 on page 4-228. 





Attributes ID_ISARO_ ELI] is a 32-bit register. 
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The following figure shows the ID ISARO_ EL! bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Figure 4-11 ID_ISARO_EL1 bit assignments 
The following table shows the ID ISARO_EL1 bit assignments. 





Table 4-39 ID_ISARO_EL1 bit assignments 








Bits |Name Function 
[31:28] | - Reserved, RESO. 
[27:24] | Divide Indicates the implemented Divide instructions: 
0x2 ¢ SDIV and UDIV in the T32 instruction set. 


e SDIV and UDIV in the A32 instruction set. 








[23:20] | Debug Indicates the implemented Debug instructions: 
6x1 BKPT. 
[19:16] | Coproc Indicates the implemented coprocessor instructions: 
0x® None implemented, except for separately attributed by the architecture including CP15, CP 14, 


Advanced SIMD and floating-point. 





[15:12] | CmpBranch | Indicates the implemented combined Compare and Branch instructions in the T32 instruction set: 





0x1 CBNZ and CBZ. 
[11:8] | Bitfield Indicates the implemented bit field instructions: 
0x1 BFC, BFI, SBFX, and UBFX. 





[7:4] | BitCount Indicates the implemented Bit Counting instructions: 





0x1 CLZ. 
[3:0] Swap Indicates the implemented Swap instructions in the A32 instruction set: 
0x0 None implemented. 

















To access the ID ISARO_ ELI: 


MRS <Xt>, ID_ISAR@_EL1 ; Read ID_ISAR@_EL1 into Xt 
Register access is encoded as follows: 


Table 4-40 ID_ISARO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0010 | 000 




















4.3.13 AArch32 Instruction Set Attribute Register 1 
The ID ISAR1_EL1 characteristics are: 





Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
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Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations [ID _ISARI1 ELI is architecturally mapped to AArch32 register ID ISARI1. See 


4.5.15 Instruction Set Attribute Register I on page 4-229. 


Attributes ID_ISAR1 ELI is a 32-bit register. 


The following figure shows the ID ISAR1_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Figure 4-12 ID_ISAR1_EL1 bit assignments 


The following table shows the ID_ISAR1_EL1 bit assignments. 


Table 4-41 ID_ISAR1_EL1 bit assignments 





Bits 


Name 


Function 





[31:28] 


Jazelle 


Indicates the implemented Jazelle state instructions: 


@x1 Adds the BXJ instruction, and the J bit in the PSR. This setting might indicate a trivial implementation of 
the Jazelle Extension. 





[27:24] 


Interwork 


Indicates the implemented interworking instructions: 


0x3 ° 


The BX instruction, and the T bit in the PSR. 

The BLX instruction. The PC loads have BX-like behavior. 

Data-processing instructions in the A32 instruction set with the PC as the destination and the S bit 
clear, have BX-like behavior. 





[23:20] 


Immediate 


Indicates the implemented data-processing instructions with long immediates: 


Q@x1 ° 


The MOVT instruction. 

The MOV instruction encodings with zero-extended 16-bit immediates. 

The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, and other ADD, 
ADR, and SUB encodings cross-referenced by the pseudocode for those encodings. 





[19:16] 


IfThen 


Indicates the implemented If-Then instructions in the T32 instruction set: 


@x1 


The IT instructions, and the IT bits in the PSRs. 





[15:12] 


Extend 


Indicates the implemented Extend instructions: 


0x2 -° 


The SXTB, SXTH, UXTB, and UXTH instructions. 
The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH instructions. 





[11:8] 








Except_ AR 





Indicates the implemented A profile exception-handling instructions: 


0x1 


The SRS and RFE instructions, and the A profile forms of the CPS instruction. 











ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-96 
reserved. 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-41 ID_ISAR1_EL1 bit assignments (continued) 





Bits Name Function 





[7:4] Except Indicates the implemented exception-handling instructions in the A32 instruction set: 


@x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction versions. 





[3:0] | Endian Indicates the implemented Endian instructions: 


0x1 The SETEND instruction, and the E bit in the PSRs. 

















To access the ID_ISAR1_EL1: 


MRS <Xt>, ID_ISAR1_EL1 ; Read ID_ISAR1_EL1 into Xt 
Register access is encoded as follows: 


Table 4-42 ID_ISAR1_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 |000 |0000 |0010 |001 




















4.3.14 AArch32 Instruction Set Attribute Register 2 
The ID_ISAR2_EL1 characteristics are: 








Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations [ID ISAR2_ ELI is architecturally mapped to AArch32 register ID_ISAR2. See 
4.5.16 Instruction Set Attribute Register 2 on page 4-231. 


Attributes ID_ISAR2_ ELI] is a 32-bit register. 


The following figure shows the ID ISAR2_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


MultiAccessint —! 
Figure 4-13 ID_ISAR2_EL1 bit assignments 
The following table shows the ID ISAR2_EL1 bit assignments. 
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Table 4-43 ID_ISAR2_EL1 bit assignments 





Bits Name 


Function 





[31:28] | Reversal 


Indicates the implemented Reversal instructions: 


0x2 The REV, REV16, REVSH, and RBIT instructions. 





[27:24] | PSR_AR 


Indicates the implemented A and R profile instructions to manipulate the PSR: 


0x1 The MRS and MSR instructions, and the exception return forms of data-processing instructions. 





Note 
The exception return forms of the data-processing instructions are: 


e Inthe A32 instruction set, data-processing instructions with the PC as the destination and the S bit set. 
¢ Inthe T32 instruction set, the SUBS PC, LR, #N instruction. 





[23:20] } MultU 


Indicates the implemented advanced unsigned Multiply instructions: 


0x2 The UMULL, UMLAL and UMAAL instructions. 





[19:16] | MultS 


Indicates the implemented advanced signed Multiply instructions. 


0x3 e The SMULL and SMLAL instructions. 
e The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, 
SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, and 
the Q bit in the PSRs. 
e The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, 
SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX 
instructions. 





[15:12] | Mult 


Indicates the implemented additional Multiply instructions: 


0x2 The MUL, MLA and MLS instructions. 





[11:8] | MultiAccessInt 


Indicates the support for interruptible multi-access instructions: 


0x0 No support. This means the LDM and STM instructions are not interruptible. 





[7:4] MemHint 


Indicates the implemented memory hint instructions: 
0x4 The PLD instruction. 
The PLI instruction. 


The PLDW instruction. 





[3:0] | LoadStore 











Indicates the implemented additional load/store instructions: 
0x2 The LDRD and STRD instructions. 


The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and Store Release 
(STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 








To access the ID_ISAR2_EL1: 


MRS <Xt>, ID_ISAR2_EL1 ; Read ID_ISAR2_EL1 into Xt 


Register access is encoded as follows: 
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Table 4-44 ID_ISAR2_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0010 | 010 




















4.3.15 AArch32 Instruction Set Attribute Register 3 
The ID _ISAR3_EL1 characteristics are: 








Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations [ID ISAR3 ELI is architecturally mapped to AArch32 register ID ISAR3. See 
4.5.17 Instruction Set Attribute Register 3 on page 4-233. 


Attributes ID_ISAR3_ ELI is a 32-bit register. 


The following figure shows the ID ISAR3_ EL]! bit assignments. 


28 27 24 23 20 19 16 15 12 11 


ThumbEE | TrueNOP |ThumbCopy] TabBranch ae ee || SIMD 


Figure 4-14 ID_ISAR3_EL1 bit assignments 
The following table shows the ID_ISAR3_EL1 bit assignments. 


Table 4-45 ID_ISAR3_EL1 bit assignments 





Bits Name Function 





[31:28] | ThumbEE | Indicates the implemented Thumb Execution Environment (T32EE) instructions: 


0x0 None implemented. 





[27:24] | TrueNOP Indicates support for True NOP instructions: 


0x1 True NOP instructions in both the A32 and T32 instruction sets, and additional NOP-compatible 
hints. 





[23:20] | ThumbCopy | Indicates the support for T32 non flag-setting MOV instructions: 


0x1 Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying from a low 
register to a low register. 





[19:16] | TabBranch | Indicates the implemented Table Branch instructions in the T32 instruction set. 


0x1 The TBB and TBH instructions. 





[15:12] | SynchPrim | Indicates the implemented synchronization primitive instructions: 


0x2 ¢ The LDREX and STREX instructions. 
¢« The CLREX, LDREXB, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 
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Table 4-45 ID_ISAR3_EL1 bit assignments (continued) 





Bits Name Function 





[11:8] | SVC Indicates the implemented SVC instructions: 


@x1 The SVC instruction. 





[7:4] SIMD Indicates the implemented Single Instruction Multiple Data (SIMD) instructions. 


0x3 ¢ The SSAT and USAT instructions, and the Q bit in the PSRs. 
e The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, SASX, 
SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, SSUB8, SSAX, 
SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, UHSUB16, UHSUB8, 
UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, USAD8, USADA8, USAT16, 
USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and the GE[3:0] bits in the PSRs. 





[3:0] Saturate Indicates the implemented Saturate instructions: 


0x1 The QADD, QDADD, QDSUB, QSUB, and the Q bit in the PSRs. 

















To access the ID_ISAR3_EL1: 


MRS <Xt>, ID_ISAR3_EL1 ; Read ID_ISAR3_EL1 into Xt 
Register access is encoded as follows: 


Table 4-46 ID_ISAR3_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 |0000 |0010 | 011 




















4.3.16 AArch32 Instruction Set Attribute Register 4 
The ID_ISAR4 ELI characteristics are: 








Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations ID _ISAR4 ELI is architecturally mapped to AArch32 register ID ISAR4. See 
4.5.18 Instruction Set Attribute Register 4 on page 4-234. 


Attributes ID_ISAR4 ELI is a 32-bit register. 


The following figure shows the ID_ISAR4 EL]! bit assignments. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





SynchPrim_frac — 


Figure 4-15 ID_ISAR4_EL1 bit assignments 
The following table shows the ID_ISAR4_EL1 bit assignments. 
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Table 4-47 ID_ISAR4_EL1 bit assignments 





Bits 


Name 


Function 





[31:28] 


SWP_frac Indicates support for the memory system locking the bus for SWP or SWPB instructions: 


Ox@ SWP and SWPB instructions not implemented. 





[27:24] 


PSR_M 


Indicates the implemented M profile instructions to modify the PSRs: 


0x0 None implemented. 





[23:20] 


SynchPrim_frac 


primitive instructions: 


0x0 e The LDREX and STREX instructions. 
e The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 


This field is used with the ID_ISAR3.SynchPrim field to indicate the implemented synchronization 





[19:16] 


Barrier 


Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 


@x1 The DMB, DSB, and ISB barrier instructions. 





[15:12] 


SMC 


Indicates the implemented SMC instructions: 


@x1 The SMC instruction. 





[11:8] 


WriteBack Indicates the support for write-back addressing modes: 


0x1 Processor supports all of the write-back addressing modes defined in ARMv8. 





[7:4] 


WithShifts Indicates the support for instructions with shifts. 


0x4 e Support for shifts of loads and stores over the range LSL 0-3. 


¢ Support for register-controlled shift options. 


¢ Support for other constant shift options, both on load/store and other instructions. 





[3:0] 








Unpriv 


Indicates the implemented unprivileged instructions. 


0x2 e The LDRBT, LDRT, STRBT, and STRT instructions. 
¢ The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 











4.3.17 


To access the ID ISAR4 EL}: 


MRS <Xt>, ID_ISAR4_EL1 ; Read ID_ISAR4_EL1 into Xt 


Register access is encoded as follows: 


Table 4-48 ID_ISAR4_EL1 access encoding 





op0 | op1 


CRn 


CRm 


op2 








11 | 000 





0000 





0010 








100 





AArch32 Instruction Set Attribute Register 5 


The ID ISAR5_EL1 characteristics are: 
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Purpose Provides information about the instruction sets that the processor implements in 
AArch32. 
Note 
The optional Cryptographic Extension is not included in the base product. ARM 
supplies the Cryptographic Extension only under an additional license to the Cortex- 
A73 MPCore processor and Advanced SIMD and floating-point support licenses. 














Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations ID ISARS EL} is architecturally mapped to AArch32 register ID ISARS. See 
4.5.19 Instruction Set Attribute Register 5 on page 4-236. 


Attributes ID_ISARS ELI is a 32-bit register. 
The following figure shows the ID ISARS ELI bit assignments. 


31 20 19 16 15 12 11 8 


7 4 3 0 


Figure 4-16 ID_ISAR5_EL1 bit assignments 
The following table shows the ID ISAR5S_EL1 bit assignments. 


Table 4-49 ID_ISAR5_EL1 bit assignments 



































Bits | Name | Function 
[31:20] | - Reserved, RESO. 
[19:16] | CRC32 | Indicates whether CRC32 instructions are implemented in AArch32 state. The value is: 
@x1 CRC32 instructions are implemented. 
[15:12] | SHA2 | Indicates whether SHA2 instructions are implemented in AArch32 state. The possible values are: 
@x@ No SHA2 instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
@x1 SHA256H, SHA256H2, SHA256SU®, and SHA256SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 
[11:8] | SHA1 | Indicates whether SHA1 instructions are implemented in AArch32 state. The possible values are: 
@x@ No SHA! instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 
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Table 4-49 ID_ISAR5_EL1 bit assignments (continued) 





Bits Name | Function 





[7:4] | AES Indicates whether AES instructions are implemented in AArch32 state. The possible values are: 
Qx® No AES instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 


0x2 AESE, AESD, AESMC, and AESIMC are implemented, plus PMULL and PMULL2 instructions operating on 
64-bit elements. This is the value if the implementation includes the Cryptographic Extension. 





[3:0] SEVL | Indicates whether the SEVL instruction is implemented. The value is: 


@x1 SEVL is implemented to send event local. 

















To access the ID ISARS_ ELI: 
MRS <Xt>, ID_ISAR5_EL1 ; Read ID_ISAR5_EL1 into Xt 


Register access is encoded as follows: 


Table 4-50 ID_ISAR5_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 000 |0000 |0010 | 101 





4.3.18 AArch32 Memory Model Feature Register 4 
The ID MMFR4 ELI characteristics are: 


Purpose Provides information about the memory model and memory management support in 
AArch32. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations ID MMFR4 EL] is architecturally mapped to AArch32 register ID_ MMFR4. See 
4.5.20 Memory Model Feature Register 4 on page 4-238. 


Attributes ID_MMFR4 ELI is a 32-bit register. 


The following figure shows the ID MMFR4 EL] bit assignments. 
31 0 


RESO 


Figure 4-17 ID_MMFR4_EL1 bit assignments 
The following table shows the ID MMFR4 EL] bit assignments. 
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Table 4-51 ID_MMFR4_EL1 bit assignments 





Bits | Name | Function 

















[31:0] | - Reserved, RESO. 





To access the ID MMFR4 ELI: 


MRS <Xt>, ID_MMFR4_EL1 ; Read ID_MMFR4_EL1 into Xt 
Register access is encoded as follows: 


Table 4-52 ID_MMFR4_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 | 0010 | 110 




















4.3.19 AArch64 Processor Feature Register 0 
The ID _AA64PFRO EL1 characteristics are: 


Purpose Provides additional information about implemented processor features in AArch64. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations ID AA64PFRO_ EL] is architecturally mapped to external register 
ID_AA64PFRO ELI. 


Attributes ID_AA64PFRO ELI is a 64-bit register. 


The following figure shows the ID_AA64PFRO_ EL] bit assignments. 


63 
RESO 


The following table shows the ID_ AA64PFRO_ EL! bit assignments. 


28 27 24 23 20 19 16 15 12 11 
EL3 EL2 EL1 ELO 
| ae | pave IME Ea handling handling handling handling 


Figure 4-18 ID_AA64PFRO_EL1 bit assignments 





Table 4-53 ID_AA64PFRO_EL1 bit assignments 











Bits |Name Function 

[63:28] | - Reserved, RESO. 

[27:24] | GIC GIC CPU interface: 
@x@ GIC CPU interface is disabled. 
@x1 GIC CPU interface is enabled. 


The input GICDISABLE defines the value of the GIC bit. 
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Table 4-53 ID_AA64PFRO_EL1 bit assignments (continued) 





Bits 


Name 


Function 





[23:20] 


AdvSIMDW 


0x0 


Advanced SIMD. The possible values are: 
Advanced SIMD is implemented. 





[19:16] 


FPW 


0x0 


Floating-point. The possible values are: 


Floating-point is implemented. 





[15:12] 


EL3 handling 


EL3 exception handling: 


0x2 Instructions can be executed at EL3 in AArch64 or AArch32 state. 





[11:8] 


EL2 handling 


EL2 exception handling: 


0x2 Instructions can be executed at EL2 in AArch64 or AArch32 state. 





[7:4] 


EL1 handling 


EL1 exception handling. The possible values are: 


0x2 Instructions can be executed at EL1 in AArch64 or AArch32 state. 





[3:0] 








ELO handling 





ELO exception handling. The possible values are: 


0x2 Instructions can be executed at ELO in AArch64 or AArch32 state. 








4.3.20 


To access the ID AA64PFRO ELI: 


MRS <Xt>, ID_AA64PFR@_EL1 ; Read ID_AA64PFR@_EL1 into Xt 


Register access is encoded as follows: 


Table 4-54 ID_AA64PFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 











11 | 000 |0000 |0100 | 000 














AArch64 Processor Feature Register 1 
The ID _AA64PFRI ELI characteristics are: 


Purpose 


Provides additional information about implemented processor features in AArch64. 


Usage constraints This register is accessible as follows: 


Configurations 


Attributes 




















ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 











ID_AA64PFRI1_ ELI is architecturally mapped to external register 
ID_AA64PFRI ELI. 


ID_AA64PFRI1_ ELI is a 64-bit register. 


The following figure shows the ID_ AA64PFR1 EL] bit assignments. 





W The FP and AdvSIMD both take the same value. 
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63 0 


RESO 


Figure 4-19 ID_AA64PFRO_EL1 bit assignments 
The following table shows the ID AA64PFR1_ EL! bit assignments. 


Table 4-55 ID_AA64PFRO_EL1 bit assignments 


Bits | Name | Function 

















[63:0] | - Reserved, RESO. 





To access the ID AA64PFRO ELI: 


MRS <Xt>, ID_AA64PFR@_EL1 ; Read ID_AA64PFR@_EL1 into Xt 
Register access is encoded as follows: 


Table 4-56 ID_AA64PFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 000 | 0000 |0100 | 000 




















4.3.21 AArch64 Debug Feature Register 0, EL1 
The ID_AA64DFRO_ ELI characteristics are: 


Purpose Provides top level information of the debug system in the AArch64 Execution state. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations ID AA64DFRO_ELI is architecturally mapped to external register ID_AA64DFRO. 
Attributes ID_AA64DFRO_EL1 is a 64-bit register. 


The following figure shows the ID_ AA64DFRO_ ELI bit assignments. 


63 32 31 28 27 24 23 20 19 16 15 12 11 





Figure 4-20 ID_AA64DFRO0_EL1 bit assignments 
The following table shows the ID_AA64DFRO_ELI bit assignments. 
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Table 4-57 ID_AA64DFRO_EL1 bit assignments 













































































Bits |Name Function 
[63:32] | - Reserved, RESO. 
[31:28] | CTX_CMPs | Number of breakpoints that are context-aware, minus 1. These are the highest numbered breakpoints: 
@x1 Two breakpoints are context-aware. 
[27:24] | - Reserved, RESO. 
[23:20] | WRPs The number of watchpoints minus 1: 
0x3 Four watchpoints. 
[19:16] | - Reserved, RESO. 
[15:12] | BRPs The number of breakpoints minus 1: 
0x5 Six breakpoints. 
[11:8] | PMUver Performance Monitors extension version. 
0x1 Performance monitor system registers implemented, PMUV3. 
[7:4] Tracever Trace extension: 
Ox@ Trace system registers not implemented. 
[3:0] Debugger | Debug architecture version: 
0x6 ARMv8-A debug architecture implemented. 
To access the ID AA64DFRO_ ELI: 
MRS <Xt>, ID_AA64DFRO@_EL1 ; Read ID_AA64DFRO_EL1 into Xt 
Register access is encoded as follows: 
Table 4-58 ID_AA64DFRO_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 |000 | 0000 | 0101 | 000 
4.3.22 AArch64 Debug Feature Register 1 
The processor does not implement ID_AA64DFR1_EL1, therefore this register is always RESO. 
4.3.23 AArch64 Auxiliary Feature Register 0 
The processor does not implement ID_AA64AFRO_ EL], therefore this register is always RESO. 
4.3.24 AArch64 Auxiliary Feature Register 1 
The processor does not implement ID_ AA64AFR1_EL1, therefore this register is always RESO. 
4.3.25 AArch64 Instruction Set Attribute Register 0, EL1 
The ID_AA64ISARO_ EL] characteristics are: 
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Purpose Provides information about the optional cryptographic instructions that the 
processor can support. 
Note 
The optional Cryptographic Extension is not included in the base product. ARM 
supplies the Cryptographic Extension only under an additional license to the Cortex- 
A73 MPCore processor and Advanced SIMD and floating-point support licenses. 














Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 























Configurations [ID AA64ISARO EL] is architecturally mapped to external register 
ID_AA64ISARO ELI. 


Attributes ID_AA64ISARO ELI is a 64-bit register. 


The following figure shows the ID_AA64ISARO_ ELI bit assignments. 
63 — 2019 16 15 12 11 8 


7 4 3 0 
RESO crose | saz | shat 


Figure 4-21 ID_AA64ISARO_EL1 bit assignments 





The following table shows the ID_ AA64ISARO_ ELI bit assignments. 


Table 4-59 ID_AA64ISARO_EL1 bit assignments 





Bits Name | Function 





[63:20] Reserved, RESO. 





[19:16] | CRC32 | Indicates whether CRC32 instructions are implemented. The value is: 


0x1 CRC32 instructions are implemented. 





[15:12] | SHA2 | Indicates whether SHA2 instructions are implemented. The possible values are: 


Ox@ No SHA2 instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 

@x1 SHA256H, SHA256H2, SHA256SU®, and SHA256SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 





[11:8] | SHA1 | Indicates whether SHA1 instructions are implemented. The possible values are: 

Ox@ No SHAL instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 

@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 
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Table 4-59 ID_AA64ISARO_EL1 bit assignments (continued) 



















































































Bits |Name | Function 
[7:4] | AES Indicates whether AES instructions are implemented. The possible values are: 
@x® No AES instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
0x2 AESE, AESD, AESMC, and AESIMC are implemented, plus PMULL and PMULL2 instructions operating on 
64-bit elements. This is the value if the implementation includes the Cryptographic Extension. 
[3:0] - Reserved, RESO. 
To access the ID AA64ISARO_ ELI: 
MRS <Xt>, ID_AA64ISAR@_EL1 ; Read ID_AA64ISAR@_EL1 into Xt 
Register access is encoded as follows: 
Table 4-60 ID_AA64ISARO_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 000 |0000 |0110 | 000 
4.3.26 AArch64 Instruction Set Attribute Register 1, EL1 
The processor does not implement ID_AA64ISAR1_ ELI, therefore this register is RES®. 
4.3.27 AArch64 Memory Model Feature Register 0, EL1 
The ID AA64MMFRO ELI characteristics are: 
Purpose Provides information about the implemented memory model and memory 
management support in the AArch64 Execution state. 
Usage constraints This register is accessible as follows: 
ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- [RO |RO [RO |RO RO 
Configurations [ID _AA64MMFRO EL] is architecturally mapped to external register 
ID_AA64MMERO ELI. 
Attributes ID_AA64MMERO ELl! is a 64-bit register. 
The following figure shows the ID AA64MMFRO_ ELI bit assignments. 
63 32 31 28 27 24 23 20 19 16 15 12 11 
Figure 4-22 ID_AA64MMFR0_EL1 bit assignments 
The following table shows the ID AA64MMFRO_ EL! bit assignments. 
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Table 4-61 ID_AA64MMFR0_EL1 bit assignments 










































































Bits |Name Function 
[63:32] | - Reserved, RESO. 
[31:28] | TGran4 Support for 4KB memory translation granule size: 
0x® Indicates that the 4KB granule is supported. 
[27:24] | TGran64 Support for 64KB memory translation granule size: 
0x® Indicates that the 64KB granule is supported. 
[23:20] | TGran16 Support for 16KB memory translation granule size: 
0x1 Indicates that the 16KB granule is supported. 
[19:16] | BigEndELO | Mixed-endian support only at ELO. 
RESO 
[15:12] | SNSMem | Secure versus Non-secure Memory distinction: 
0x1 Supports a distinction between Secure and Non-secure Memory. 
[11:8] | BigEnd Mixed-endian configuration support: 
@x1 Mixed-endian support. The SCTLR_ELx.EE and SCTLR_EL1.EOE bits are RW. 
[7:4] ASIDBits | Number of ASID bits: 
0x2 16 bits. 
[3:0] PARange | Physical address range supported: 
0x2 40-bit physical address range, that is, 1 TByte. 
To access the ID AA64MMFRO ELI: 
MRS <Xt>, ID_AA64MMFR@_EL1 ; Read ID_AA64MMFR@_EL1 into Xt 
Register access is encoded as follows: 
Table 4-62 ID_AA64MMFRO_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 |000 | 0000 | 0111 | 000 
4.3.28 AArch64 Memory Model Feature Register 1 
The processor does not implement ID_ AA64MMFRO ELI, therefore this register is RESO. 
4.3.29 Cache Size ID Register 
The CCSIDR_EL1 characteristics are: 
Purpose Provides information about the architecture of the caches. 
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Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations © CCSIDR_ELI is architecturally mapped to AArch32 register CCSIDR. See 
4.5.21 Cache Size ID Register on page 4-238. 


Attributes CCSIDR_ELI is a 32-bit register. 


The following figure shows the CCSIDR_EL] bit assignments. 


31 30 29 28 27 13 12 3 2 0 


| NumSets Associativity 
wT — L_ WA LineSize — 
WB RA 


Figure 4-23 CCSIDR_EL1 bit assignments 





The following table shows the CCSIDR_EL1 bit assignments. 


Table 4-63 CCSIDR_EL1 bit assignments 





Bits 


Name Function 





[31] 


WT Indicates support for write-through: 


(2 Cache level does not support write-through. 





[30] 


WB Indicates support for write-back: 


(3 Cache level does not support write-back. 


1 Cache level supports write-back. 





[29] 


RA Indicates support for Read-Allocation: 


[2] Cache level does not support Read-Allocation. 


1 Cache level supports Read-Allocation. 





[28] 


WA Indicates support for Write-Allocation: 


[2] Cache level does not support Write-Allocation. 
1 Cache level supports Write-Allocation. 





[27:13] 


NumSets* Indicates the number of sets in cache minus |. Therefore, a value of 0 indicates 1 set in the cache. The 
number of sets does not have to be a power of 2. 





[12:3] 


Associativity” | Indicates the associativity of cache minus 1. Therefore, a value of 0 indicates an associativity of 1. The 
associativity does not have to be a power of 2. 





[2:0] 








LineSizeY Indicates the (log (number of words in cache line)) minus 2: 


0x2 16 words per line. 














X For more information about encoding, see Table 4-198 CCSIDR encodings on page 4-240. 
Y Table 4-198 CCSIDR encodings on page 4-240 shows the individual bit field and complete register encodings for the CCSIDR. The CSSELR determines which 
CCSIDR to select. 
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The following table shows the individual bit field and complete register encodings for the CCSIDR_EL1. 
The CSSELR determines which CCSIDR_EL1 to select. 


To access the CCSIDR_ELI: 


MRS <Xt>, CCSIDR_EL1 ; Read CCSIDR_EL1 into Xt 


Register access is encoded as follows: 


Table 4-64 CCSIDR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 001 | 0000 | 0000 | 000 




















4.3.30 Cache Level ID Register 


The CLIDR_ELI characteristics are: 


Purpose Identifies: 


¢ The type of cache, or caches, implemented at each level. 
¢ The Level of Coherency and Level of Unification for the cache hierarchy. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 























Configurations = CLIDR_ ELI is architecturally mapped to AArch32 register CLIDR. See 
4.5.22 Cache Level ID Register on page 4-240. 


Attributes CLIDR_ELI is a 64-bit register. 


The following figure shows the CLIDR_EL1 bit assignments. 
633029 2726 2423 2120 1817 1514 1211 


RESO jou | toc | LoUIS | Ctype7 | Ctype6 | Ctype5|Ctype4 | Ctype3 | Ctype2 | Ctype1 


Figure 4-24 CLIDR_EL1 bit assignments 
The following table shows the CLIDR_EL] bit assignments. 


Table 4-65 CLIDR_EL1 bit assignments 
































Bits |Name | Function 
[63:30] | - Reserved, RESO. 
[29:27] | LoUU | Indicates the Level of Unification Uniprocessor for the cache hierarchy: 
@x1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or invalidating to 
the point of unification for the processor. 
[26:24] | LoC Indicates the Level of Coherency for the cache hierarchy: 
0x2 L2 cache implemented. A clean to the point of coherency operation requires the L1 and L2 caches to 
be cleaned. 
ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-112 
reserved. 


Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-65 CLIDR_EL1 bit assignments (continued) 







































































Bits |Name | Function 
[23:21] | LoUIS | Indicates the Level of Unification Inner Shareable for the cache hierarchy: 
0x1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or invalidating to 
the point of unification for the Inner Shareable shareability domain. 
[20:18] | Ctype7 | Indicates the type of cache if the processor implements L7 cache: 
0x0 L7 cache not implemented. 
[17:15] | Ctype6 | Indicates the type of cache if the processor implements L6 cache: 
0x0 L6 cache not implemented. 
[14:12] | Ctype5 | Indicates the type of cache if the processor implements L5 cache: 
0x0 L5 cache not implemented. 
[11:9] | Ctype4 | Indicates the type of cache if the processor implements L4 cache: 
0x0 L4 cache not implemented. 
[8:6] Ctype37 | Indicates the type of cache if the processor implements L3 cache: 
0x0 L3 cache not implemented. 
[5:3] Ctype2 | Indicates the type of cache if the processor implements L2 cache: 
0x4 L2 cache is implemented as a unified cache. 
[2:0] Ctypel | Indicates the type of cache implemented at L1: 
0x3 Separate instruction and data caches at L1. 
To access the CLIDR_ELI: 
MRS <Xt>, CLIDR_EL1 ; Read CLIDR_EL1 into Xt 
Register access is encoded as follows: 
Table 4-66 CLIDR_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 |001 |0000 |0000 | 001 
4.3.31 Auxiliary ID Register 
The processor does not implement AIDR_EL1, so this register is always RESo. 
4.3.32 Cache Size Selection Register 


The CSSELR_ELI characteristics are: 


Purpose Selects the current 4.5.27 Cache Size ID Register on page 4-238, by specifying: 
e The required cache level. 
¢ The cache type, either instruction or data cache. 





z 


If software reads the Cache Type fields from Ctypel upwards, after it has seen a value of @b0@®, no caches exist at further-out levels of the hierarchy. So, for 


example, if Ctype2 is the first Cache Type field with a value of @b0QQ, the value of Ctype3 must be ignored. 
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Usage constraints This register is accessible as follows: 








ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW |RW [RW | RW RW 























Configurations © CSSELR_ELI is architecturally mapped to AArch32 register CSSELR(NS). See 
4.5.24 Cache Size Selection Register on page 4-242. 


Attributes CSSELR_EL1 is a 32-bit register. 


The following figure shows the CSSELR_EL1 bit assignments. 


Figure 4-25 CSSELR_EL1 bit assignments 
The following table shows the CSSELR_EL1 bit assignments. 


Table 4-67 CSSELR_EL1 bit assignments 


Bits |Name | Function 





[31:4] Reserved, RESO 





[3:1] | Level®* | Cache level of required cache: 
@beee Ll. 

@bee1 L2. 
@b@10-@b111 Reserved. 





[0] InD* | Instruction not Data bit: 


(2) Data or unified cache. 


1 Instruction cache. 

















To access the CSSELR_EL1: 


MRS <Xt>, CSSELR_EL1 ; Read CSSELR_EL1 into Xt 
MSR CSSELR_EL1, <Xt> ; Write Xt to CSSELR_EL1 


Register access is encoded as follows: 


Table 4-68 CSSELR_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 010 | 0000 | 0000 | 000 








aa The combination of Level=0b001 and InD=1 is reserved. 
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4.3.33 Cache Type Register 
The CTR_ELO characteristics are: 


Purpose Provides information about the architecture of the caches. 
Usage constraints This register is accessible as follows: 








ELO |EL1 |EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config |RO |RO |RO |RO RO 























This register is accessible at ELO when SCTLR_EL1.UCT is set to 1. 


Configurations CTR_ELO is architecturally mapped to AArch32 register CTR. See 4.5.25 Cache 
Type Register on page 4-243. 
Attributes CTR_ELO is a 32-bit register. 


The following figure shows the CTR_ELO bit assignments. 


3130 2827 24 23 20 19 16 15 14 13 4 3 0 





Figure 4-26 CTR_ELO bit assignments 
The following table shows the CTR_ELO bit assignments. 


Table 4-69 CTR_ELO bit assignments 





Bits Name Function 














[31] - Reserved, RES1. 

[30:28] | - Reserved, RESO. 

[27:24] | CWG Cache Write-Back granule. Log, of the number of words of the maximum size of memory that can be overwritten 
as a result of the eviction of a cache entry that has had a memory location in it modified: 
0x4 Cache Write-Back granule size is 16 words. 

[23:20] | ERG Exclusives Reservation Granule. Log, of the number of words of the maximum size of the reservation granule 


that has been implemented for the Load-Exclusive and Store-Exclusive instructions: 


0x4 Exclusive reservation granule size is 16 words. 





[19:16] | DminLine | Log, of the number of words in the smallest cache line of all the data and unified caches that the processor 
controls: 


0x4 Smallest data cache line size is 16 words. 





[15:14] | Lip L1 Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction cache: 
0b10 Virtually Indexed Physically Tagged (VIPT). 





[13:4] |- Reserved, RESO. 





[3:0] |IminLine | Log, of the number of words in the smallest cache line of all the instruction caches that the processor controls: 




















0x4 Smallest instruction cache line size is 16 words. 
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To access the CTR_ELO: 
MRS <Xt>, CTR_EL@ ; Read CTR_EL@ into Xt 
Register access is encoded as follows: 


Table 4-70 CTR_ELO access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 011 | 0000) 0000 | 001 





4.3.34 Data Cache Zero ID Register 
The DCZID_ELO characteristics are: 


Purpose Indicates the block size written with byte values of zero by the DC ZVA (Cache Zero 
by Address), system instruction. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RO |RO |RO IRO [RO RO 























Configurations There are no configuration notes. 
Attributes DCZID_ELO is a 32-bit register. 


The following figure shows the DCZID_ELO bit assignments. 


31 5 43 0 
DZP— 


Figure 4-27 DCZID_ELO bit assignments 
The following table shows the DCZID_ELO bit assignments. 


Table 4-71 DCZID_ELO bit assignments 





Bits |Name Function 





[31:5] | - Reserved, RESO. 





[4] DZP 7) DC ZVA instruction permitted. 





[3:0] | BlockSize | Log2 of the block size in words: 
0x4 The block size is 16 words. 

















To access the DCZID_ELO: 


MRS <Xt>, DCZID_EL@ ; Read DCZID_EL®@ into Xt 


Register access is encoded as follows: 
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Table 4-72 DCZID_ELO access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 011 | 0000 |0000 | 111 





4.3.35 Virtualization Processor ID Register 
The VPIDR_EL2 characteristics are: 


Purpose 
Holds the value of the Virtualization Processor ID. This is the value returned by Non-secure 
ELI reads of MIDR. See 4.3.1 Main ID Register, EL] on page 4-81. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |-  |- [RW IRW : 


























Configurations 
VPIDR_EL2 is architecturally mapped to AArch32 register VPIDR. See 4.5.26 Virtualization 
Processor ID Register on page 4-244. 

Attributes 
VPIDR_EL2 is a 32-bit register. 


VPIDR_EL2 resets to the value of MIDR_EL1. 
The following figure shows the VPIDR_EL2 bit assignments. 


31 0 


VPIDR 


Figure 4-28 VPIDR_EL2 bit assignments 
The following table shows the VPIDR_EL2 bit assignments. 


Table 4-73 VPIDR_EL2 bit assignments 





Bits | Name | Function 





[31:0] | VPIDR | MIDR value returned by Non-secure PL1 reads of the MIDR. The MIDR description defines the subdivision of this 
value. See 4.3.1 Main ID Register, EL] on page 4-81. 

















To access the VPIDR_EL2: 


MRS <Xt>, VPIDR_EL2 ; Read VPIDR_EL2 into Xt 
MSR VPIDR_EL2, <Xt> ; Write Xt to VPIDR_EL2 


Register access is encoded as follows: 


Table 4-74 VPIDR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0000 | 0000 | 000 




















4.3.36 Virtualization Multiprocessor ID Register 
The VMPIDR_EL2 characteristics are: 
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Purpose 
Provides the value of the Virtualization Multiprocessor ID. This is the value returned by Non- 
secure ELI reads of MPIDR. 

Usage constraints 
This register is accessible as follows: 








ELO | EL1 | EL1|EL2| EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW IRW : 


























Configurations 
VMPIDR_EL2[31:0] is architecturally mapped to AArch32 register VMPIDR. See 
4.5.27 Virtualization Multiprocessor ID Register on page 4-245. 

Attributes 
VMPIDR_EL2 is a 64-bit register. 


VMPIDR_EL2 resets to the value of MPIDR_EL2. 
The following figure shows the VMPIDR_EL2 bit assignments. 
63 0 


VMPIDR 


Figure 4-29 VMPIDR_EL2 bit assignments 
The following table shows the VMPIDR_EL2 bit assignments. 


Table 4-75 VMPIDR_EL2 bit assignments 





Bits | Name Function 





[63:0] | VMPIDR | MPIDR value returned by Non-secure EL1 reads of the MPIDR_EL1. The MPIDR description defines the 
subdivision of this value. See 4.3.2 Multiprocessor Affinity Register on page 4-82. 














To access the VMPIDR_EL2: 


MRS <Xt>, VMPIDR_EL2 ; Read VMPIDR_EL2 into Xt 
MSR VMPIDR_EL2, <Xt> ; Write Xt to VMPIDR_EL2 


Register access is encoded as follows: 


Table 4-76 VMPIDR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 0000 |0000 | 101 




















4.3.37 System Control Register, EL1 
The SCTLR_ELI characteristics are: 
Purpose Provides top-level control of the system, including its memory system at EL1. 


SCTLR_EL} is part of the Virtual memory control registers functional group. 
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Configurations 


4 System Control 


4.3 AArch64 register descriptions 




















ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 








4.5.28 System Control Register on page 4-246. 


Attributes 


SCTLR_EL} is a 32-bit register. 


The following figure shows the SCTLR_EL1 bit assignments. 





SCTLR_ELI is architecturally mapped to AArch32 register SCTLR(NS) See 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 109 8 76543210 





Lsa 
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CP15BEN 
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UCI 
EE 
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nTWw 
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THEE 
ITD 
SED 
UMA 
-__RESO 
RES1 


Figure 4-30 SCTLR_EL1 bit assignments 


The following table shows the SCTLR_EL1 bit assignments. 


Table 4-77 SCTLR_EL1 bit assignments 


























Bits |Name Function 

[31:30] | - Reserved, RESO. 

[29:28] | - Reserved, RES1. 

[27] - Reserved, RESO. 

[26] UCI Enables ELO access to the DC CVAU, DC CIVAC, DC CVAC and IC IVAU instructions in the AArch64 Execution 
state. The possible values are: 
[3] ELO access disabled. This is the reset value. 
1 ELO access enabled. 

[25] EE Exception endianness. The value of this bit controls the endianness for explicit data accesses at EL1. This value 


also indicates the endianness of the translation table data for translation table lookups. The possible values of this 


bit are: 
(2) Little-endian. 
1 Big-endian. 


The reset value of this bit is determined by the CFGEND configuration pin. 
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Table 4-77 SCTLR_EL1 bit assignments (continued) 





Bits Name Function 





[24] EOE Endianness of explicit data access at ELO. The possible values are: 


© Explicit data accesses at ELO are little-endian. This is reset value. 


1 Explicit data accesses at ELO are big-endian. 














[23:22] | - Reserved, RES1. 
[21] - Reserved, RESO. 
[20] - Reserved, RES1. 
[19] WXN Write permission implies Execute Never (XN). This bit can be used to require all memory regions with write 


permissions to be treated as XN. The possible values are: 


© Regions with write permission are not forced XN. This is the reset value. 


1 Regions with write permissions are forced XN. 





[18] nTWE WFE non-trapping. The possible values are: 


@ A WFE instruction executed at ELO, that, if this bit was set to 1, would permit entry to a low-power state, is 
trapped to EL1. 


1 WFE instructions executed as normal. This is the reset value. 





[17] - Reserved, RESO. 





[16] nTWI WFI non-trapping. The possible values are: 


© AWFT instruction executed at ELO, that, if this bit was set to 1, would permit entry to a low-power state, is 
trapped to EL1. 


1 WFI instructions executed as normal. This is the reset value. 





[15] UCT Enables ELO access to the CTR_ELO register in AArch64 Execution state. The possible values are: 


© Disables ELO access to the CTR_ELO register. This is the reset value. 
1 Enables ELO access to the CTR_ELO register. 





[14] DZE Enables access to the DC ZVA instruction at ELO. The possible values are: 


© Disables execution access to the DC ZVA instruction at ELO. The instruction is trapped to EL1. This is the 
reset value. 


1 Enables execution access to the DC ZVA instruction at ELO. 





[13] - Reserved, RESO. 





[12] I Instruction cache enable. The possible values are: 


© Instruction (L1) and unified (L2) caches disabled for instruction fetch. This is the reset value. 


1 Instruction (L1) and unified (L2) caches enabled for instruction fetch. 





[11] - Reserved, RES1. 





[10] - Reserved, RESO. 





[9] UMA User Mask Access. Controls access to interrupt masks from ELO, when ELO is using AArch64. The possible 
values of this bit are: 


© Disable access to the interrupt masks from ELO. This is the reset value. 


1 Enable access to the interrupt masks from ELO. 
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Table 4-77 SCTLR_EL1 bit assignments (continued) 





Bits 


Name 


Function 





SED 


SETEND instruction disable. The possible values are: 


@ The SETEND instruction is enabled. This is the reset value. 


1 The SETEND instruction is UNDEFINED. 





ITD 


Reserved, RESO.AII IT instruction functionality is enabled at ELO using AArch32. 





THEE 


RESO T32EE is not implemented. 





CP1IS5BEN 


CP15 barrier enable. The possible values are: 


© CP15 barrier operations disabled. Their encodings are UNDEFINED. 


1  CP15 barrier operations enabled. This is the reset value. 





[4] 


SAO 


Enable ELO stack alignment check. The possible values are: 


@ Disable ELO stack alignment check. 
1 Enable ELO stack alignment check. This is the reset value. 





[3] 


SA 


Enable SP alignment check. The possible values are: 


2) Disable SP alignment check. 


1 Enable SP alignment check. This is the reset value. 





[2] 


Cache enable. The possible values are: 


@ Data (L1) and unified (L2) caches disabled for data access. This is the reset value. 


1 Data (L1) and unified (L2) caches enabled for data access. 





Alignment check enable. The possible values are: 


@ Alignment fault checking disabled. This is the reset value. 
1 = Alignment fault checking enabled. 











MMU enable. The possible values are: 


© ELl and ELO stage 1 MMU disabled. This is the reset value. 
1 ELl and ELO stage 1 MMU enabled. 








4.3.38 


4.3.39 


To access the SCTLR_EL1: 


MRS <Xt>, SCTLR_EL1 ; Read SCTLR_EL1 into Xt 
MSR SCTLR_EL1, <Xt> ; Write Xt to SCTLR_EL1 


Auxiliary Control Register, EL1 


The processor does not implement the ACTLR_ELI register. This register is always RESO. 


Auxiliary Control Register, EL2 
The ACTLR_EL2 characteristics are: 


Purpose 


such as ECTLR, L2CTLR, and L2ECTLR. 


Controls write access to IMPLEMENTATION DEFINED registers in Non-secure EL1 modes, 
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Usage constraints This register is accessible as follows: 


Configurations 


Attributes 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- |. [RW [RW RW 























The ACTLR_EL2 is architecturally mapped to the AArch32 HACTLR register. See 
4.5.35 Hyp Auxiliary Control Register on page 4-258. 


ACTLR_EL2? is a 32-bit register. 


The following figure shows the ACTLR_EL2 bit assignments. 


L2ECTLR_EL1 access sono 
L2CTLR_EL1 access control 
ECTLR_EL1 access control 


RESO 





Figure 4-31 ACTLR_EL2 bit assignments 


The following table shows the ACTLR_EL2 bit assignments. 


Table 4-78 ACTLR_EL2 bit assignments 





Name 


Function 





Reserved, RESO. 





L2ECTLR_EL1 access 
control 


L2ECTLR_EL]1 write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1. This is the reset value. 


1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR_EL3[5] to be set. 





[4] 


L2CTLR_EL]I access control 


L2CTLR_EL1 write access control. The possible values are: 


© The register is not write accessible from Non-secure EL1. This is the reset value. 


1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR_EL3[4] to be set. 





[3:2] 


Reserved, RESO. 





[1] 


ECTLR_EL]I access control 


ECTLR_EL1 write access control. The possible values are: 


@ The register is not write accessible from Non-secure EL1. This is the reset value. 


1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR_EL3[1] to be set. 











Reserved, RESO. 
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To access the ACTLR_EL2: 


MRS <Xt>, ACTLR_EL2 ; Read ACTLR_EL2 into Xt 


MSR ACTLR_EL2, 


<Xt> ; Write Xt to ACTLR_EL2 


Auxiliary Control Register, EL3 
The ACTLR_EL3 characteristics are: 


Purpose 


Controls write access to IMPLEMENTATION DEFINED registers in EL2, such as ECTLR, 


L2CTLR, and L2ECTLR. 


Usage constraints This register is accessible as follows: 


Configurations 


Attributes 





ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 


0) 





- - - - RW RW 























ACTLR_EL3 is mapped to AArch32 register ACTLR (S). See 4.5.29 Auxiliary 
Control Register on page 4-249. 


ACTLR EL3 is a 32-bit register. 


The following figure shows the ACTLR_EL3 bit assignments. 


31 


6 ie j 


RESO co | 


L2ECTLR_EL1 access — 
L2CTLR_EL1 access control 
ECTLR_EL1 access control 


RESO 





Figure 4-32 ACTLR_EL3 bit assignments 


The following table shows the ACTLR_EL3 bit assignments. 


Table 4-79 ACTLR_EL3 bit assignments 





Name 


Function 





Reserved, RESO. 





L2ECTLR_ELI1 access 
control 


L2ECTLR_EL1 write access control. The possible values are: 


1 The register is write accessible from EL2. 


© The register is not write accessible from a lower exception level. This is the reset value. 

















[4] L2CTLR_ELI access control | L2CTLR_EL]1 write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 
1 The register is write accessible from EL2. 

[3:2] |- Reserved, RESO. 
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Table 4-79 ACTLR_EL3 bit assignments (continued) 





Bits |Name Function 





[1] ECTLR_EL!1 access control ECTLR_EL1 write access control. The possible values are: 
© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 

















[0] - Reserved, RESO. 





To access the ACTLR_EL3: 


MRS <Xt>, ACTLR_EL3 ; Read ACTLR_EL3 into Xt 
MSR ACTLR_EL3, <Xt> ; Write Xt to ACTLR_EL3 


4.3.41 Architectural Feature Access Control Register 
The CPACR_ELI characteristics are: 


Purpose Controls access to trace functionality and access to registers associated with 
Advanced SIMD and Floating-point execution. 


CPACR_ELI is part of the Other system registers functional group. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 























Configurations © CPACR_ ELI is architecturally mapped to AArch32 register CPACR. See 
4.5.30 Architectural Feature Access Control Register on page 4-250. 


Attributes CPACR_ ELI is a 32-bit register. 


The following figure shows the CPACR_EL1 bit assignments. 


31 29 28 27 22 21 20 19 0 
== {f= 
L_TTA L_FPEN 
Figure 4-33 CPACR_EL1 bit assignments 
The following table shows the CPACR_EL]1 bit assignments. 


Table 4-80 CPACR_EL1 bit assignments 





Bits Name | Function 





[31:29] Reserved, RESO. 





[28] TTA | Causes access to the Trace functionality to trap to EL1 when executed from ELO or EL1. 


This bit is RESO. 





[27:22] Reserved, RESO. 
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Table 4-80 CPACR_EL1 bit assignments (continued) 





Bits Name | Function 





[21:20] | FPEN | Traps instructions that access registers associated with Advanced SIMD and Floating-point execution to trap to EL1 
when executed from ELO or EL1. The possible values are: 


@bxe@ Trap any instruction in ELO or EL1 that uses registers associated with Advanced SIMD and Floating-point 
execution. The reset value is @b@O. 


@b@1 Trap any instruction in ELO that uses registers associated with Advanced SIMD and Floating-point 
execution. Instructions in EL1 are not trapped. 


@b11 No instructions are trapped. 

















[19:0] Reserved, RESO. 





To access the CPACR_ELI: 


MRS <Xt>, CPACR_EL1 ; Read CPACR_EL1 into Xt 
MSR CPACR_EL1, <Xt> ; Write Xt to CPACR_EL1 


4.3.42 System Control Register, EL2 
The SCTLR_EL2 characteristics are: 


Purpose Provides top level control of the system, including its memory system at EL2. 
SCTLR_EL2 is part of: 
¢ The Virtual memory control registers functional group. 
¢ The Hypervisor and virtualization registers functional group. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- =- [RW [RW RW 























Configurations © SCTLR_EL2 is architecturally mapped to AArch32 register HSCTLR. See 
4.5.36 Hyp System Control Register on page 4-259. 


Attributes SCTLR_EL2 is a 32-bit register. 


The following figure shows the SCTLR_EL2 bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 6543210 





EE Lreso wxn— L RES1 L RES1 LSA 


RES1 RESO 
Figure 4-34 SCTLR_EL2 bit assignments 
The following table shows the SCTLR_EL2 bit assignments. 


Table 4-81 SCTLR_EL2 bit assignments 





Bits Name | Function 





[31:30] Reserved, RESO. 





[29:28] Reserved, RES1. 





[27:26] Reserved, RESO. 
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Table 4-81 SCTLR_EL2 bit assignments (continued) 





Bits 


Name 


Function 





[25] 


EE 


Exception endianness. The possible values are: 


e Little endian. 


1 Big endian. 





[24] 


Reserved, RESO. 





[23:22] 


Reserved, RES1. 





[21:20] 


Reserved, RESO. 





[19] 


WXN 


Force treatment of all memory regions with write permissions as XN. The possible values are: 


(2) Regions with write permissions are not forced XN. This is the reset value. 


1 Regions with write permissions are forced XN. 





Reserved, RES1. 





Reserved, RESO. 





Reserved, RES1. 





[15:13] 


Reserved, RESO. 








[12] 


Instruction cache enable. The possible values are: 


e Instruction (L1) and unified (L2) caches disabled. 
1 Instruction (L1) and unified (L2) caches enabled. 





[11] 


Reserved, RES1. 





[10:6] 


Reserved, RESO. 





[5:4] 


Reserved, RES1. 





[3] 


SA 


Enables stack alignment check. The possible values are: 


e Disables stack alignment check. 


1 Enables stack alignment check. 





[2] 


Global enable for data and unifies caches. The possible values are: 


e Data (L1) and unified (L2) caches disabled. 
1 Data (L1) and unified (L2) caches enabled. 





Enable alignment fault check. The possible values are: 


e Disables alignment fault checking. 
1 Enables alignment fault checking. 





[0] 











Global enable for the EL2 MMU. The possible values are: 


(2) Disables EL2 MMU. 
1 Enables EL2 MMU. 








To access the SCTLR_EL2: 


MRS <Xt>, SCTLR_EL2 ; Read SCTLR_EL2 into Xt 
MSR SCTLR_EL2, <Xt> ; Write Xt to SCTLR_EL2 
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4.3.43 Hypervisor Configuration Register 
The HCR_EL2 characteristics are: 


Purpose Provides configuration control for virtualization, including whether various Non- 
secure operations are trapped to EL2. 


HCR_EL2 is part of the Hypervisor and virtualization registers functional group. 


Usage This register is accessible as follows: 
constraints 





ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - - RW | RW RW 























Configurations HCR EL2[31:0] is architecturally mapped to AArch32 register HCR. See 
4.5.37 Hyp Configuration Register on page 4-262. 


HCR_EL2[63:32] is architecturally mapped to AArch32 register HCR2. See 
4.5.38 Hyp Configuration Register 2 on page 4-266. 


Attributes HCR_EL2? is a 64-bit register. 
The following figure shows the HCR_EL2 bit assignments. 


34 33 32 31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 8 76543 2 1 0 


PS ii 













































































ID a is VM 
eal | LS 
RW PTW 

TRVM FMO 
HCD IMO 
TDZ AMO 
TGE VF 
TVM VI 

TTLB — VSE 

TPU — — FB 
TPC —— — BSU 
TSW — DC 

TACR —_— — TWI 

TIDCP ——____~ TWE 
TSC ————_J TIDO 
TID3 TID1 
TID2 








Figure 4-35 HCR_EL2 bit assignments 
The following table shows the HCR_EL2 bit assignments. 
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Table 4-82 HCR_EL2 bit assignments 





Bits Name | Function 





[63:34] | - Reserved, RESO. 





[33] ID Disables stage 2 instruction cache. When HCR_EL2.VM is 1, this forces all stage 2 translations for instruction 
accesses to Normal memory to be Non-cacheable for the EL1/ELO0 translation regimes. The possible values are: 


© Has no effect on stage 2 EL1/ELO translation regime for instruction accesses. This is the reset value. 


1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable for the EL1/ELO 
translation regime. 





[32] CD Disables stage 2 data cache. When HCR_EL2.VM is 1, this forces all stage 2 translations for data accesses and 
translation table walks to Normal memory to be Non-cacheable for the EL1/EL0 translation regimes. The possible 
values are: 


© Has no effect on stage 2 EL1/ELO translation regime for data access or translation table walks. This is the reset 
value. 


1 Forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non- 
cacheable for the EL1/ELO translation regime. 





[31] RW Register width control for lower Exception levels. The possible values are: 


© Lower levels are all AArch32. This is the reset value. 


1 ELI is AArch64. ELO is determined by the register width that is described in the current processing state when 
executing at ELO. 





[30] TRVM | Trap reads of Virtual Memory controls.®? The possible values are: 


© Non-secure EL! reads are not trapped. This is the reset value. 


1  Non-secure EL! reads are trapped to EL2. 





[29] HCD | Reserved, RESO. 





[28] TDZ | Traps DC ZVA instruction. The possible values are: 


@ DC ZVA instruction is not trapped. This is the reset value. 
1 DC ZVA instruction is trapped to EL2 when executed in Non-secure EL1 or ELO. 





[27] TGE |Traps general exceptions. If this bit is set, and SCR_EL3.NS is set, then: 

° All Non-secure EL1 exceptions are routed to EL2. 

¢ For Non-secure EL1, the SCTLR_ELI1.M bit is reset to 0 regardless of its actual state other than the purpose of 
reading the bit. 

e The HCR_EL2.FMO, HCR_EL2.IMO, and HCR_EL2.AMO bits are treated as 1 regardless of their actual state 
other than for the purpose of reading the bits. 

¢ All virtual interrupts are disabled. 

°. Any implementation defined mechanisms for signaling virtual interrupts are disabled. 

e An exception return to Non-secure EL! is treated as an illegal exception return. 


The reset value is 0. 





[26] TVM_| Trap virtual memory controls.*” The possible values are: 


@ Non-secure EL1 writes are not trapped. This is the reset value. 


1  Non-secure EL! writes are trapped to EL2. 
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Table 4-82 HCR_EL2 bit assignments (continued) 





Bits 


Name 


Function 





[25] 


TTLB 


Traps TLB maintenance instructions.*” The possible values are: 


© Non-secure EL1 TLB maintenance instructions are not trapped. This is the reset value. 


1 TLB maintenance instructions that are executed from Non-secure EL1 that are not UNDEFINED are trapped to 
EL2. 





[24] 


TPU 


Traps cache maintenance instructions to Point of Unification (POU).*° The possible values are: 


© Cache maintenance instructions are not trapped. This is the reset value. 


1 Cache maintenance instructions to the POU executed from Non-secure EL1 or ELO that are not UNDEFINED are 
trapped to EL2. 





[23] 


TPC 


Traps data or unified cache maintenance instructions to Point of Coherency (POC).*® The possible values are: 


@ Data or unified cache maintenance instructions are not trapped. This is the reset value. 


1 Data or unified cache maintenance instructions by address to the POC executed from Non-secure EL1 or ELO 
that are not UNDEFINED are trapped to EL2. 





[22] 


TSW 


Traps data or unified cache maintenance instructions by Set or Way.*” The possible values are: 


@ Data or unified cache maintenance instructions are not trapped. This is the reset value. 


1 Data or unified cache maintenance instructions by Set or Way executed from Non-secure EL1 that are not 
UNDEFINED are trapped to EL2 are not trapped. 





[21] 


TACR 


Traps Auxiliary Control registers. The possible values are: 


© Accesses to Auxiliary Control registers are not trapped. This is the reset value. 


1 Accesses to ACTLR in AArch32 state or the ACTLR_EL1 in the AArch64 state from Non-secure EL1 are 
trapped to EL2. 





[20] 


TIDCP 


Trap Implementation Dependent functionality. When 1, this causes accesses to the following instruction set space 
executed from Non-secure EL1 to be trapped to EL2: 
AArch32 All CP15 MCR and MRC instructions as follows: 


e CRn is 9, Opcodel is 0 to 7, CRm is c0, cl, c2, c5, c6, c7, or c8, and Opcode? is 0 to 7. 
e CRn is 10, Opcode1 is 0 to 7, CRm is c0, cl, c4, or c8, and Opcode? is 0 to 7. 
e CRn is 11, Opcodel is 0 to 7, CRm is c0 to c8, or c15, and Opcode? is 0 to 7. 


AArch64 Reserved control space for IMPLEMENTATION DEFINED functionality. 


Accesses from ELO are UNDEFINED. The reset value is 0. 





[19] 


TSC 


Traps SMC instruction. The possible values are: 


© SMC instruction is not trapped. This is the reset value. 


1 SMC instruction executed in Non-secure EL] is trapped to EL2 for AArch32 and AArch64 Execution states. 





[18] 








TID3 


Traps ID group 3 registers.*> The possible values are: 


@ ID group 3 register accesses are not trapped. This is the reset value. 


1 Reads to ID group 3 registers executed from Non-secure EL] are trapped to EL2. 
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Table 4-82 HCR_EL2 bit assignments (continued) 





Bits Name | Function 





[17] TID2 | Traps ID group 2 registers.* The possible values are: 


@ ID group 2 register accesses are not trapped. This is the reset value. 


1 Reads to ID group 2 registers and writes to CSSELR and CSSELR_ELlexecuted from Non-secure EL1 or ELO, 
if not UNDEFINED, are trapped to EL2. 





[16] TID1 | Traps ID group 1 registers.*> The possible values are: 


© ID group | register accesses are not trapped. This is the reset value. 


1 Reads to ID group 1 registers executed from Non-secure EL] are trapped to EL2. 





[15] TIDO | Traps ID group 0 registers.*” The possible values are: 


© ID group 0 register accesses are not trapped. This is the reset value. 


1 Reads to ID group 0 registers executed from Non-secure EL] are trapped to EL2. 





14 TWE | Traps WFE instruction if it would cause suspension of execution. For example, if there is no pending WFE event. The 
p p 

possible values are: 

© WFE instruction is not trapped. This is the reset value. 


1 WFE instruction executed in Non-secure EL1 or ELO is trapped to EL2 for AArch32 and AArch64 Execution 
states. 





13 TWI Traps WFT instruction if it causes suspension of execution. For example, if there is no pending WFI event. The 
p p 

possible values are: 

© WFI instruction is not trapped. This is the reset value. 


1 WFT instruction executed in Non-secure EL1 or ELO is trapped to EL2 for AArch32 and AArch64 Execution 
states. 





[12] DC Default cacheable. When this bit is set it causes: 


e SCTLR_EL1.M to behave as 0 for all purposes other than reading the bit. 
e HCR_EL2.VM to behave as 1 for all purposes other than reading the bit. 


The memory type produced by the first stage of translation in Non-secure EL1 and ELO is Non-shareable, Inner 
Write-Back Write-Allocate, Outer Write-Back Write-Allocate. The reset value is ©. 





[11:10] | BSU | Barrier shareability upgrade. Determines the minimum shareability domain that is supplied to any barrier executed 
from Non-secure EL1 or ELO. The possible values are: 


e@bee No effect. This is the reset value. 
@be1 Inner Shareable. 

b10 Outer Shareable. 

@b11 Full system. 


This value is combined with the specified level of the barrier held in its instruction, according to the algorithm for 
combining shareability attributes. 





[9] FB Forces broadcast.*° The possible values are: 


© Instructions are not broadcast. This is the reset value. 


1 Forces instruction broadcast within Inner Shareable domain when executing from Non-secure EL1. 
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Table 4-82 HCR_EL2 bit assignments (continued) 





Bits 


Name | Function 





[8] 


VSE 


Virtual System Error/Asynchronous Abort. The possible values are: 
© Virtual System Error/Asynchronous Abort is not pending by this mechanism. This is the reset value. 


1 Virtual System Error/Asynchronous Abort is pending by this mechanism. 


The virtual System Error/Asynchronous Abort is enabled only when the HCR_EL2.AMO bit is set. 





[7] 


VI 


Virtual IRQ interrupt. The possible values are: 
© Virtual IRQ is not pending by this mechanism. This is the reset value. 


1 Virtual IRQ is pending by this mechanism. 


The virtual IRQ is enabled only when the HCR_EL2.IMO bit is set. 





[6] 


VF 


Virtual FIQ interrupt. The possible values are: 
© Virtual FIQ is not pending by this mechanism. This is the reset value. 


1 Virtual FIQ is pending by this mechanism. 


The virtual FIQ is enabled only when the HCR_EL2.FMO bit is set. 





AMO 


Asynchronous abort and error interrupt routing. The possible values are: 


@ Asynchronous external aborts and SError Interrupts while executing at Exception levels lower than EL2 are not 
taken at EL2. Virtual System Error/Asynchronous Abort is disabled. This is the reset value. 


1 Asynchronous external aborts and SError Interrupts while executing at EL2 or lower are taken in EL2 unless 
routed by SCTLR_EL3.EA bit to EL3. Virtual System Error/Asynchronous Abort is enabled. 





[4] 


IMO 


Physical IRQ routing. The possible values are: 
© Physical IRQ while executing at Exception levels lower than EL2 are not taken at EL2. Virtual IRQ interrupt is 
disabled. This is the reset value. 


1 Physical IRQ while executing at EL2 or lower are taken in EL2 unless routed by SCTLR_EL3.IRQ bit to EL3. 
Virtual IRQ interrupt is enabled. 





[3] 


FMO 


Physical FIQ routing. The possible values are: 
© Physical FIQ while executing at Exception levels lower than EL2 are not taken at EL2. Virtual FIQ interrupt is 
disabled. This is the reset value. 


1 Physical FIQ while executing at EL2 or lower are taken in EL2 unless routed by SCTLR_EL3.FIQ bit to EL3. 
Virtual FIQ interrupt is enabled. 





[2] 


PTW 


Protected Table Walk. When this bit is set, if the stage 2 translation of a translation table access, made as part of a 
stage | translation table walk at ELO or EL1, maps to Device memory, the access is faulted as a stage 2 Permission 
fault. The reset value is ©. 





[1] 


SWIO 


Set/Way Invalidation Override. Non-secure EL1 execution of the data cache invalidate by set/way instruction is 
treated as data cache clean and invalidate by set/way. When this bit is set: 

e DCISW is treated as DCCISW when in the AArch32 Execution state. 

e DC ISW is treated as DC CISW when in the AArch64 Execution state. 


This bit is RES1. 





[0] 








VM 


Enables second stage of translation. The possible values are: 


@ Disables second stage translation. This is the reset value. 


1 Enables second stage translation for execution in Non-secure EL1 and ELO. 
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4.3 AArch64 register descriptions 


To access the HCR_EL2: 


MRS <Xt>, HCR_EL2 ; Read HCR_EL2 into Xt 
MSR HCR_EL2, <Xt> ; Write Xt to HCR_EL2 


4.3.44 Hyp Debug Control Register 
The MDCR_EL2 characteristics are: 


Purpose Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to 
functions provided by the debug and trace architectures and the Performance 
Monitor. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Configurations * MDCR EL2 is architecturally mapped to AArch32 register HDCR. See 
4.5.39 Hyp Debug Control Register on page 4-267. 
e This register is accessible only at EL2 or EL3. 


Attributes MDCR _EL2 is a 32-bit register. 


The following figure shows the MDCR_EL2 bit assignments. 


31 1211109 8 7 6 5 4 


ae 


a 
HPME 
TDE 
TDA 
TDOSA 
TDRA 














Figure 4-36 MDCR_EL2 bit assignments 
The following table shows the MDCR_EL2? bit assignments. 





ab See the ARM” Architecture Reference Manual ARMvé6, for ARMv8-A architecture profile for the registers covered by this setting. 
ac See the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile for the instructions covered by this setting. 
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4 System Control 
4.3 AArch64 register descriptions 


Table 4-83 MDCR_EL2 bit assignments 





Bits Name _| Function 





[31:12] Reserved, RESO. 





[11] TDRA |Trap debug ROM address register access. 
@ Has no effect on accesses to debug ROM address registers from EL1 and ELO. 
1 Trap valid Non-secure EL1 and ELO access to debug ROM address registers to Hyp mode. 


When this bit is set to 1, any access to the following registers from EL1 or ELO is trapped to EL2: 


e AArch32: DBGDRAR, DBGDSAR. 
e AArch64: MDRAR ELl. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is 1, then this bit is ignored and treated as though it is 1 other than for 
the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 





[10] TDOSA | Trap Debug OS-related register access: 
© Has no effect on accesses to OS-related debug registers. 


1 Trap valid Non-secure accesses to OS-related debug registers to EL2. 


When this bit is set to 1, any access to the following registers from EL1 or ELO is trapped to EL2: 


e AArch32: DBGOSLAR, DBGOSLSR, DBGOSDLR, DBGPRCR. 
e AArch64: OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, DBGPRCR_EL1. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is 1, then this bit is ignored and treated as though it is 1 other than for 
the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 





[9] TDA Trap Debug Access: 
© Has no effect on accesses to Debug registers. 


1 Trap valid Non-secure accesses to Debug registers to EL2. 


When this bit is set to 1, any valid Non-secure access to the debug registers from EL1 or ELO, other than the 
registers trapped by the TDRA and TDOSA bits, is trapped to EL2. 


If HCR_EL2.TGE is 1 or MDCR_EL2.TDE is 1, then this bit is ignored and treated as though it is 1 other than for 
the value read back from MDCR_EL2. 


On Warm reset, the field resets to 0. 





[8] TDE Trap software debug exceptions: 


© Has no effect on software debug exceptions. 


1 Route Software debug exceptions from Non-secure EL1 and ELO to EL2. Also enables traps on all debug 
register accesses to EL2. 


If HCR_EL2.TGE is 1, then this bit is ignored and treated as though it is 1 other than for the value read back from 
MDCR_EL2. This bit resets to 0. 





[7] HPME | Hypervisor Performance Monitor Enable: 


e EL2 performance monitor counters disabled. 


1 EL2 performance monitor counters enabled. 


When this bit is set to 1, the Performance Monitors counters that are reserved for use from EL2 or Secure state are 
enabled. For more information see the description of the HPMN field. 


This bit resets to 0. 
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4.3 AArch64 register descriptions 


Table 4-83 MDCR_EL2 bit assignments (continued) 





Bits Name _| Function 





[6] TPM Trap Performance Monitor accesses: 
@ Has no effect on performance monitor accesses. 


1 Trap Non-secure ELO and EL1 accesses to Performance Monitors registers that are not unallocated to EL2. 


This bit resets to 0. 





[5] TPMCR | Trap PMCR_ELO accesses: 

© Has no effect on PMCR_ELO accesses. 

1 Trap Non-secure ELO and EL1 accesses to PMCR_ELO to EL2. 
This bit resets to 0. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 





[4:0] | HPMN | Hyp Performance Monitor count. Defines the number of Performance Monitors counters that are accessible from 
Non-secure EL1 and ELO modes. 


In Non-secure state, HPMN divides the Performance Monitors counters as follows. For counter n in Non-secure 
state: 


For example, If PMnEVCNTR is performance monitor counter n then, in Non-secure state: 


e Ifnis inthe range 0 <n <HPMN, the counter is accessible from EL1 and EL2, and from ELO if permitted by 
PMUSERENR_ELO. PMCR_ELO.E enables the operation of counters in this range. 

e Ifnis in the range HPMN <n <6, the counter is accessible only from EL2. MDCR_EL2.HPME enables the 
operation of counters in this range. 


There are six performance counters, specified by PMCR.N. 
If the field is set to 0, then Non-secure ELO or EL1 has no access to any counters. 
If the field is set to a value greater than six, the behavior is the same as if the value is six. 


For reads of MDCR_EL2.HPMN by EL2 or higher, if this field is set to 0 or to a value larger than PMCR_ELO.N, 
the processor returns the value that was written to MDCR_EL2.HPMN. 


This field resets to @x6. 

















To access the MDCR_EL2: 


MRS <Xt>, MDCR_EL2 ; Read MDCR_EL2 into Xt 
MSR MDCR_EL2, <Xt> ; Write Xt to MDCR_EL2 


4.3.45 Architectural Feature Trap Register, EL2 
The CPTR_EL2 characteristics are: 


Purpose Controls trapping to EL2 for accesses to CPACR, Trace functionality and registers 
associated with Advanced SIMD and Floating-point execution. Controls EL2 access 
to this functionality. 


Usage constraints This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- [RW | Rw RW 
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4 System Control 
4.3 AArch64 register descriptions 


Configurations §= CPTR_EL2 is architecturally mapped to AArch32 register HCPTR. See 4.5.40 Hyp 
Architectural Feature Trap Register on page 4-270. 


Attributes CPTR_EL2 is a 32-bit register. 


The following figure shows the CPTR_EL2 bit assignments. 


31 30 21 20 19 14 13 1211 10 9 0 
LTCPAC LTTA reso! LTFP 


Figure 4-37 CPTR_EL2 bit assignments 
The following table shows the CPTR_EL2 bit assignments. 


Table 4-84 CPTR_EL2 bit assignments 





Bits Name | Function 





[31] TCPAC | Traps direct access to CPACR from Non-secure EL1 to EL2. The possible values are: 


© Access to CPACR is not trapped. This is the reset value. 
1 Access to CPACR is trapped. 





[30:21] Reserved, RESO. 





[20] TTA Trap Trace Access. 


Not implemented. RESO. 

















[19:14] | - Reserved, RESO. 

[13:12] | - Reserved, RES1. 

[11] - Reserved, RESO. 

[10] TFP Traps instructions that access registers associated with Advanced SIMD and Floating-point execution from a lower 
exception level to EL2, unless trapped to EL1. The possible values are: 
7) Instructions are not trapped. This is the reset value. 
1 Instructions are trapped. 

[9:0] - Reserved, RES1. 

















To access the CPTR_EL2: 


MRS <Xt>, CPTR_EL2 ; Read CPTR_EL2 into Xt 
MSR CPTR_EL2, <Xt> ; Write Xt to CPTR_EL2 


4.3.46 Hyp System Trap Register 
The HSTR_EL2 characteristics are: 
































Purpose Controls access to ThumbEE and coprocessor registers at lower exception levels in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 
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4.3 AArch64 register descriptions 


Configurations © HSTR_EL2 is architecturally mapped to AArch32 register HSTR. See 4.5.47 Hyp 
System Trap Register on page 4-284. 
Attributes HSTR_EL2 is a 32-bit register. 


The following figure shows the HSTR_EL2 bit assignments. 


17 16 15 14 13 1211109876543210 




















TTEE 1 B TO 
T15 T1 
RESO T2 
T13 T3 
T12 RESO 
T11 T5 
T10 —— L T6 
T9 T7 
T8 








Figure 4-38 HSTR_EL2 bit assignments 
The following table shows the HSTR_EL2 bit assignments. 


Table 4-85 HSTR_EL2 bit assignments 















































Bits | Name | Function 
[31:17] | - Reserved, RESO. 
[16] TTEE | Trap T32EE. This value is: 

(2) T32EE is not supported. 
[15] T15 Trap coprocessor primary register CRn = 15. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 15 to Hyp mode. 
[14] - Reserved, RESO. 
[13] T13 Trap coprocessor primary register CRn = 13. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 13 to Hyp mode. 
[12] T12 Trap coprocessor primary register CRn = 12. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 12 to Hyp mode. 
[11] T11 Trap coprocessor primary register CRn = 11. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 11 to Hyp mode. 
[10] T10 Trap coprocessor primary register CRn = 10. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 10 to Hyp mode. 
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Table 4-85 HSTR_EL2 bit assignments (continued) 





















































Bits Name | Function 
[9] T9 Trap coprocessor primary register CRn = 9. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 9 to Hyp mode. 
[8] T8 Trap coprocessor primary register CRn = 8. The possible values are: 

@ Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 8 to Hyp mode. 
[7] T7 Trap coprocessor primary register CRn = 7. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 7 to Hyp mode. 
[6] T6 Trap coprocessor primary register CRn = 6. The possible values are: 

@ Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 6 to Hyp mode. 
[5] T5 Trap coprocessor primary register CRn = 5. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 5 to Hyp mode. 
[4] - Reserved, RESO. 
[3] T3 Trap coprocessor primary register CRn = 3. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 3 to Hyp mode. 
[2] T2 Trap coprocessor primary register CRn = 2. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 2 to Hyp mode. 
[1] T1 Trap coprocessor primary register CRn = 1. The possible values are: 

© Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 1 to Hyp mode. 
[0] TO Trap coprocessor primary register CRn = 0. The possible values are: 

@ Has no effect on Non-secure accesses to CP15 registers. This is the reset value. 

1 Trap valid Non-secure accesses to coprocessor primary register CRn = 0 to Hyp mode. 

To access the HSTR_EL2: 
MRS <Xt>, HSTR_EL2 ; Read HSTR_EL2 into Xt 
MSR HSTR_EL2, <Xt> ; Write Xt to HSTR_EL2 
4.3.47 Hyp Auxiliary Configuration Register 
The processor does not implement HACR_EL2, so this register is always RESO. 
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4 System Control 


4.3 AArch64 register descriptions 


System Control Register, EL3 


The SCTLR_EL3 characteristics are: 


Purpose Provides top level control of the system, including its memory system at EL3. 


SCTLR_EL3 is part of the Virtual memory control registers functional group. 


Usage constraints This register is accessible as follows: 





ELO | EL1 | EL1 | EL2 | EL3 
(NS) | (S) (SCR.NS = 1) 


EL3 
(SCR.NS = 0) 





Se - |- IRW 

















RW 








Configurations © SCTLR_EL3 is mapped to AArch32 register SCTLR(S). See 4.5.28 System Control 


Register on page 4-246. 
Attributes SCTLR_EL3 is a 32-bit register. 


The following figure shows the SCTLR_EL3 bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 201918171615 131211109 8 76543210 





EE L Reso WXN -H L RES1 Lres1 
RES1 RESO 
Figure 4-39 SCTLR_EL3 bit assignments 
The following table shows the SCTRLR_EL3 bit assignments. 


Table 4-86 SCTLR_EL3 bit assignments 





Bits 


Name 


Function 





[31:30] 


Reserved, RESO. 





[29:28] 


Reserved, RES1. 





[27:26] 


Reserved, RESO. 





[25] 


EE 


Exception endianness. This bit controls the endianness for: 
e Explicit data accesses at EL3. 
e Stage 1 translation table walks at EL3. 


The possible values are: 
(2) Little endian. This is the reset value. 


1 Big endian. 


The input CFGEND defines the reset value of the EE bit. 





[24] 


Reserved, RESO. 





[23:22] 


Reserved, RES1. 





[21:20] 


Reserved, RESO. 





[19] 


WXN 


Force treatment of all memory regions with write permissions as XN. The possible values are: 


© Regions with write permissions are not forced XN. This is the reset value. 


1 Regions with write permissions are forced XN. 





[18] 











Reserved, RES1. 
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4.3 AArch64 register descriptions 


Table 4-86 SCTLR_EL3 bit assignments (continued) 





Bits 


Name 


Function 





[17] 


Reserved, RESO. 





[16] 


Reserved, RES1. 





[15:13] 


Reserved, RESO. 





[12] 


Global instruction cache enable. The possible values are: 


© Instruction (L1) and unified (L2) caches disabled. This is the reset value. 
1 Instruction (L1) and unified (L2) caches enabled. 





Reserved, RES1. 





Reserved, RESO. 





Reserved, RES1. 





SA 


Enables stack alignment check. The possible values are: 


© Disables stack alignment check. 


1 Enables stack alignment check. This is the reset value. 





[2] 


Global enable for data and unified caches. The possible values are: 


© Data (L1) and unified (L2) caches disabled. This is the reset value. 
1 Data (L1) and unified (L2) caches enabled. 





Enable alignment fault check. The possible values are: 


© Disables alignment fault checking. This is the reset value. 


1 Enables alignment fault checking. 





[0] 











Global enable for the EL3 MMU. The possible values are: 


(2) Disables EL3 MMU. This is the reset value. 
1 Enables EL3 MMU. 








4.3.49 


To access the SCTLR_EL3: 


MRS <Xt>, SCTLR_EL3 ; Read SCTLR_EL3 into Xt 
MSR SCTLR_EL3, <Xt> ; Write Xt to SCTLR_EL3 


Secure Configuration Register 


The SCR_EL3 characteristics are: 


Purpose Defines the configuration of the security state. SCR_EL3 specifies: 
e Security state of ELO and ELI, either Secure or Non-secure. 


e Register width at lower Exception levels. 


¢ The Exception level that the processor takes exceptions at, if an IRQ, FIQ, or 


external abort occurs. 


SCR_EL3 is part of the Security registers functional group. 
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Usage This register is accessible as follows: 
constraints 





ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - - - RW RW 























Configurations SCR _EL3 is mapped to AArch32 register SCR. See 4.5.31 Secure Configuration 
Register on page 4-252. 


Attributes SCR_EL3 is a 32-bit register. 


The following figure shows the SCR_EL3 bit assignments. 


14131211109 8 76543 2 1 









































Figure 4-40 SCR_EL3 bit assignments 
The following table shows the SCR_EL3 bit assignments. 


Table 4-87 SCR_EL3 bit assignments 





Bits Name | Function 





[31:14] Reserved, RESO. 





[13] TWE | Traps WFE instructions. The possible values are: 


© WFE instructions are not trapped. This is the reset value. 
1 WFE instructions executed in AArch32 or AArch64 from EL2, EL1 or ELO are trapped to EL3 if the instruction 
would otherwise cause suspension of execution, that is if: 


« The event register is not set. 
e There is not a pending WFE wakeup event. 
¢ The instruction is not trapped at EL2 or EL1. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 





[12] TWI |Traps WFI instructions. The possible values are: 


© WFI instructions are not trapped. This is the reset value. 


1 WFT instructions executed in AArch32 or AArch64 from EL2, EL1 or ELO are trapped to EL3 if the instruction 
would otherwise cause suspension of execution, that is if there is not a pending WFI wakeup event and the 
instruction is not trapped at EL2 or EL1. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 
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Table 4-87 SCR_EL3 bit assignments (continued) 





Bits Name | Function 





[11] ST Enable Secure EL1 access to CNTPS_TVAL_EL1, CNTS_CTL_EL1, and CNTPS_CVAL_EL!1 registers. The 
possible values are: 


© Registers accessible only in EL3. This is the reset value. 
1 Registers accessible in EL3 and EL1 when SCR_EL3.NS is 0. 





[10] RW Register width control for lower Exception levels. The possible values are: 


(2) Lower levels are all AArch32. This is the reset value. 


1 The next lower level is AArch64. 





[9] SIF Secure Instruction Fetch. When the processor is in Secure state, this bit disables instruction fetches from Non-secure 
memory. The possible values are: 


© Secure state instruction fetches from Non-secure memory are permitted. This is the reset value. 


1 Secure state instruction fetches from Non-secure memory are not permitted. 





[8] HCE | Hyp Call enable. This bit enables the use of HVC instructions. The possible values are: 


@ The HVC instruction is UNDEFINED at all Exception levels. This is the reset value. 


1 The HVC instruction is enabled at EL1, EL2 or EL3. 





[7] SMD |SMC instruction disable. The possible values are: 


© The SMC instruction is enabled at EL1, EL2, and EL3. This is the reset value. 


1 The SMC instruction is UNDEFINED at all Exception levels. At EL1, in the Non-secure state, the HCR_EL2.TSC 
bit has priority over this control. 











[6] - Reserved, RESO. 

[5:4] - Reserved, RES1. 

[3] EA External abort and SError interrupt Routing. This bit controls which mode takes external aborts. The possible values 
are: 


© External aborts and SError Interrupts while executing at Exception levels other than EL3 are not taken in EL3. 
This is the reset value. 


1 External aborts and SError Interrupts while executing at all Exception levels are taken in EL3. 





[2] FIQ Physical FIQ Routing. The possible values are: 


© Physical FIQ while executing at Exception levels other than EL3 are not taken in EL3. This is the reset value. 
1 Physical FIQ while executing at all Exception levels are taken in EL3. 





[1] IRQ |Physical IRQ Routing. The possible values are: 


© Physical IRQ while executing at Exception levels other than EL3 are not taken in EL3. This is the reset value. 
1 Physical IRQ while executing at all Exception levels are taken in EL3. 





[0] NS Non-secure bit. The possible values are: 


© ELO and EL! are in Secure state, memory accesses from those Exception levels can access Secure memory. This 
is the reset value. 


1 ELO and EL! are in Non-secure state, memory accesses from those Exception levels cannot access Secure 
memory. 
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To access the SCR_EL3: 


MRS <Xt>, SCR_EL3 ; Read SCR_EL3 into Xt 
MSR SCR_EL3, <Xt> ; Write Xt to SCR_EL3 


4.3.50 Secure Debug Enable Register 
The SDER32_EL3 characteristics are: 


Purpose Allows access to the AArch32 register SDER only from AArch64 state. Its value 
has no effect on execution in AArch64 state. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- fe |. [Rw RW 























Configurations SDER32_EL3 is architecturally mapped to AArch32 register SDER. See 
4.5.32 Secure Debug Enable Register on page 4-254. 


Attributes SDER32_EL3 is a 32-bit register. 


The following figure shows the SDER32_EL3 bit assignments. 


SUNIDEN | 
SUIDEN 
Figure 4-41 SDER32_EL3 bit assignments 


The following table shows the SDER32_EL3 bit assignments. 


Table 4-88 SDER32_EL3 bit assignments 





Bits |Name Function 





(31:2] | - Reserved, RESO. 





[1] SUNIDEN | Secure User Non-invasive Debug Enable. The possible values are: 
@ Non-invasive debug not permitted in Secure ELO mode. This is the Warm reset value. 


1 Non-invasive debug permitted in Secure ELO mode. 





[0] SUIDEN | Secure User Invasive Debug Enable. The possible values are: 


@ Invasive debug not permitted in Secure ELO mode. This is the Warm reset value. 


1 Invasive debug permitted in Secure ELO mode. 

















To access the SDER32_EL3: 


MRS <Xt>, SDER32_EL3 ; Read SDER32_EL3 into Xt 
MSR SDER32_EL3, <Xt> ; Write Xt to SDER32_EL3 


4.3.51 Translation Table Base Register 0, EL1 
The TTBRO_ ELI characteristics are: 
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Purpose Holds the base address of translation table 0, and information about the memory it 
occupies. This is one of the translation tables for the stage 1 translation of memory 
accesses from modes other than Hyp mode. 








Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 























Any of the fields in this register are permitted to be cached in a TLB. 


Configurations TTBRO ELI is architecturally mapped to AArch32 register TTBRO. See 
4.5.41 Translation Table Base Register 0 on page 4-272. 


Attributes TTBRO_EL] is a 64-bit register. 


The following figure shows the TTBRO_ EL] bit assignments. 
63 48 47 0 


ASID BADDR[47:x] 


Figure 4-42 TTBRO_EL1 bit assignments 
The following table shows the TTBRO_EL1 bit assignments. 


Table 4-89 TTBRO_EL1 bit assignments 





Bits Name Function 





[63:48] | ASID An ASID for the translation table base address. The TCR_EL1.A1 field selects either TTBRO_EL1.ASID or 
TTBR1_EL1.ASID. 





[47:0] | BADDR[47:x] | Translation table base address, bits[47:x]. Bits [x-1:0] are RESO. 
x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation granule size. 


For instructions on how to calculate it, see the ARM” Architecture Reference Manual ARMV8, for ARMv8-A 


architecture profile. 
The value of x determines the required alignment of the translation table, that must be aligned to 2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:0] are treated as if all the bits are zero. The value read back 
from those bits is the value written. 

















To access the TTBRO_EL1: 


MRS <Xt>, TTBR@_EL1 ; Read TTBR@_EL1 into Xt 
MSR TTBR@_EL1, <Xt> ; Write Xt to TTBR@_EL1 


4.3.52 Translation Table Base Register 1 
The TTBR1_EL1 characteristics are: 


Purpose Holds the base address of translation table 1, and information about the memory it 
occupies. This is one of the translation tables for the stage | translation of memory 
accesses at ELO and EL1. 
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Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 




















Any of the fields in this register are permitted to be cached in a TLB. 





Configurations TTBRI1 ELI is architecturally mapped to AArch32 register TTBR1 (NS). See 
4.5.42 Translation Table Base Register 1 on page 4-275. 


Attributes TTBR1_ELl1 is a 64-bit register. 
The following figure shows the TTBR1_EL1 bit assignments. 
63 48 47 0 


ASID BADDR[47:x] 


Figure 4-43 TTBR1_EL1 bit assignments 
The following table shows the TTBR1_EL1 bit assignments. 


Table 4-90 TTBR1_EL1 bit assignments 





Bits Name Function 





[63:48] | ASID An ASID for the translation table base address. The TCR_EL1.A1 field selects either TTBRO_EL1.ASID or 
TTBR1_EL1.ASID. 





[47:0] | BADDR[47:x] | Translation table base address, bits[47:x]. Bits [x-1:0] are RESO. 
x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation granule size. 


For instructions on how to calculate it, see the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A 


architecture profile. 
The value of x determines the required alignment of the translation table, that must be aligned to 2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:0] are treated as if all the bits are zero. The value read back 
from those bits is the value written. 

















To access the TTBR1_EL1: 


MRS <Xt>, TTBR1_EL1 ; Read TTBR1_EL1 into Xt 
MSR TTBR1_EL1, <Xt> ; Write Xt to TTBR1_EL1 


4.3.53 Architectural Feature Trap Register, EL3 
The CPTR_EL3 characteristics are: 


Purpose Controls trapping to EL3 for accesses to CPACR, Trace functionality and registers 
associated with Advanced SIMD and Floating-point execution. Controls EL3 access 
to this functionality. 


CPTR_EL3 is part of the Security registers functional group. 
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4 System Control 
4.3 AArch64 register descriptions 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
a fe fe tee) RW RW 























Configurations There are no configuration notes. 
Attributes CPTR_EL3 is a 32-bit register. 


The following figure shows the CPTR_EL3 bit assignments. 


31 30 21 20 19 1413121110 9 0 
L_TCPAC L_TTA REsO—! [|—tTFP 


Figure 4-44 CPTR_EL3 bit assignments 
The following table shows the CPTR_EL3 bit assignments. 


Table 4-91 CPTR_EL3 bit assignments 





Bits 


Name 


Function 





[31] 


TCPAC 


This causes a direct access to the CPACR_EL1 from EL1 or the CPTR_EL2 from EL2 to trap to EL3 unless it is 
trapped at EL2. The possible values are: 

© Does not cause access to the CPACR_EL1 or CPTR_EL2 to be trapped. 

1 Causes access to the CPACR_EL1 or CPTR_EL2 to be trapped. 





[30:21] 


Reserved, RESO. 





[20] 


TTA 


Trap Trace Access. 


Not implemented. RESO. 





[19:14] 


Reserved, RESO. 





[13:12] 


Reserved, RES1. 





[11] 


Reserved, RESO. 





[10] 


TFP 


This causes instructions that access the registers associated with Advanced SIMD or floating-point execution to trap 
to EL3 when executed from any exception level, unless trapped to EL1 or EL2. The possible values are: 


© Does not cause any instruction to be trapped. This is the reset value. 


1 Causes any instructions that use the registers associated with Advanced SIMD or floating-point execution to be 
trapped. 





[9:0] 











Reserved, RES1. 








4.3.54 


To access the CPTR_EL3: 


MRS <Xt>, CPTR_EL3 ; Read CPTR_EL3 into Xt 
MSR CPTR_EL3, <Xt> ; Write Xt to CPTR_EL3 


Monitor Debug Configuration Register, EL3 


The MDCR_EL3 characteristics are: 


Purpose Provides configuration options for Security to self-hosted debug. 
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4.3 AArch64 register descriptions 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
p = z z RW RW 























Configurations | MDCR_EL3 is mapped to AArch32 register SDCR. See 4.5.34 Secure Debug 
Configuration Register on page 4-256. 


Attributes MDCR _ EL3 is a 32-bit register. 


The following figure shows the MDCR_EL3 bit assignments. 


22 21 20 19 18 17 16151413 11109 8 7 65 





EPMAD — = SPD32 Le TDA L- TPM 
EDAD Lee Bae 


SPME 


Figure 4-45 MDCR_EL3 bit assignments 
The following table shows the MDCR_EL3 bit assignments. 


Table 4-92 MDCR_EL3 bit assignments 





Bits 


Name 


Function 





[31:22] 


Reserved, RESO. 





[21] 


EPMAD 


External debugger access to Performance Monitors registers disabled. This disables access to these registers by an 
external debugger. The possible values are: 


@ Access to Performance Monitors registers from external debugger is permitted. 


1 Access to Performance Monitors registers from external debugger is disabled, unless overridden by 
authentication interface. 


The reset value is @b@. 





[20] 


EDAD 


External debugger access to breakpoint and watchpoint registers disabled. This disables access to these registers by 
an external debugger. The possible values are: 


@ Access to breakpoint and watchpoint registers from external debugger is permitted. 


1 Access to breakpoint and watchpoint registers from external debugger is disabled, unless overridden by 
authentication interface. 


The reset value is @b@. 





[19:18] 


Reserved, RESO. 





[17] 








SPME 


Secure performance monitors enable. This enables event counting exceptions from Secure state. The possible 
values are: 


© Event counting prohibited in Secure state. This is the reset value. 


1 Event counting allowed in Secure state. 
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4.3 AArch64 register descriptions 


Table 4-92 MDCR_EL3 bit assignments (continued) 





Bits Name _| Function 





[16] SDD AArch64 secure debug disable. Disables Software debug exceptions from Secure state if Secure EL1 is using 
AArch64, other than from Software breakpoint instructions. The possible values are: 


@ Debug exceptions from Secure ELO are enabled, and debug exceptions from Secure EL] are enabled if 
MDSCR_EL1.KDE is 1 and PSTATE.D is 0. 


1 Debug exceptions from all exception levels in Secure state are disabled. 


The reset value is UNKNOWN. 





[15:14] | SPD32 | AArch32 secure privileged debug. Enables or disables debug exceptions from Secure state if Secure EL1 is using 
AArch32, other than Software breakpoint instructions. The possible values are: 


@bee@ Legacy mode. Debug exceptions from Secure EL1 are enabled only if 
AArch32SelfHostedSecurePrivilegedInvasiveDebugEnabled( ). 


@b@1 Reserved. 
@b1@ Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 
@b11 Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 


The reset value is @b@0. 





[13:11] Reserved, RESO. 





[10] TDOSA | Trap accesses to the OS debug system registers, OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1 
OS. 


© Accesses are not trapped. 


1 Accesses to the OS debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 





[9] TDA Trap accesses to the remaining sets of debug registers to EL3. 


© Accesses are not trapped. 


1 Accesses to the remaining debug system registers are trapped to EL3. 


The reset value is UNKNOWN. 











[8:7] |- Reserved, RESO. 

[6] TPM Trap Performance Monitors accesses. The possible values are: 
© Accesses are not trapped. 
1 Accesses to the Performance Monitor registers are trapped to EL3. 
The reset value is UNKNOWN. 

[5:0] |- Reserved, RESO. 

















To access the MDCR_EL3: 


MRS <Xt>, MDCR_EL3 ; Read EL3 Monitor Debug Configuration Register 
MSR MDCR_EL3, <Xt> ; Write EL3 Monitor Debug Configuration Register 


4.3.55 Translation Control Register, EL1 
The TCR_EL1 characteristics are: 
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63 


4 System Control 
4.3 AArch64 register descriptions 


Purpose Determines which Translation Base Registers define the base address register for a 
translation table walk required for stage 1 translation of a memory access from ELO 
or EL1 and holds cacheability and shareability information. 


TCR_ELI is part of the Virtual memory control registers functional group. 








Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 























Configurations TCR ELl is architecturally mapped to AArch32 register TTBCR(NS). See 
4.5.43 Translation Table Base Control Register on page 4-277. 


Attributes TCR_ELI is a 64-bit register. 


The following figure shows the TCR_EL1 bit assignments. 


39 38 37 36 35 34 32 31 30 29 28 27 26 25 24 23 22 21 161514131211109 8 7 6 5 


0 
e es ORGN1 S | L RESO 
Ro | EPDO 
Ee a IRGNO 
TBI ORGNO 


Figure 4-46 TCR_EL1 bit assignments 










T18Z 





The following table shows the TCR_EL!1 bit assignments. 


Table 4-93 TCR_EL1 bit assignments 





Bits 


Name 


Function 





[63:39] 


Reserved, RESO. 





[38] 


TBII 


Top Byte Ignored. Indicates whether the top byte of the input address is used for address match for the 
TTBR1_EL1 region. The possible values are: 


(2] Top byte used in the address calculation. 


1 Top byte ignored in the address calculation. 





[37] 


TBIO 


Top Byte Ignored. Indicates whether the top byte of the input address is used for address match for the 
TTBRO_EL1 region. The possible values are: 


(2) Top byte used in the address calculation. 


1 Top byte ignored in the address calculation. 





[36] 


AS 


ASID size. The possible values are: 
(2 8-bit. 
1 16-bit. 








[35] 











Reserved, RES0. 
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4 System Control 
4.3 AArch64 register descriptions 


Table 4-93 TCR_EL1 bit assignments (continued) 















































Bits |Name | Function 
[34:32] | IPS Intermediate Physical Address Size. The possible values are: 
@beee@ 32 bits, 4GB. 
b001 36 bits, 64GB. 
@be1e 40 bits, ITB. 
All other values are reserved. 
[31:30] | TG1 TTBR1_EL1 granule size. The possible values are: 
ebee Reserved. 
0b10 4KB. 
@b11 64KB. 
All other values are not supported. 
[29:28] | SH1 Shareability attribute for memory associated with translation table walks using TTBR1_EL1. The possible values 
are: 
@bee Non-shareable. 
@be1 Reserved. 
0b10 Outer shareable. 
@b11 Inner shareable. 
[27:26] | ORGN1 | Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL1. The possible 
values are: 
@bee Normal memory, Outer Non-cacheable. 
@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
b10 Normal memory, Outer Write-Through Cacheable. 
0b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
[25:24] | IRGN1 | Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL1. The possible 
values are: 
@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
[23] EPD1 _ | Translation table walk disable for translations using TTBR1_EL1. Controls whether a translation table walk is 
performed on a TLB miss for an address that is translated using TTBR1_EL1. The possible values are: 
e Perform translation table walk using TTBR1_EL1. 
1 A TLB miss on an address translated from TTBR1_EL1 generates a Translation fault. No translation 
table walk is performed. 
[22] Al Selects whether TTBRO_EL1 or TTBR1_EL1 defines the ASID. The possible values are: 
(2) TTBRO_EL1.ASID defines the ASID. 
1 TTBR1_EL1.ASID defines the ASID. 
[21:16] | TISZ Size offset of the memory region addressed by TTBR1_EL1. The region size is 2(6^T1S2) bytes. 
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4 System Control 
4.3 AArch64 register descriptions 


Table 4-93 TCR_EL1 bit assignments (continued) 





Bits 


Name 


Function 





[15:14] 


TGO 


TTBRO_EL1 granule size. The possible values are: 


Q@bee 4KB. 
Q@be1 64KB. 
@b11 Reserved. 


All other values are not supported. 





[13:12] 


SHO 


Shareability attribute for memory associated with translation table walks using TTBRO_EL1. The possible values 
are: 


@bee Non-shareable. 
@be1 Reserved. 

@b10 Outer shareable. 
@b11 Inner shareable. 





[11:10] 


ORGNO 


Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL1. The possible 
values are: 


b00 Normal memory, Outer Non-cacheable. 

b01 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] 


IRGNO 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL1. The possible 
values are: 

ebee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 





EPDO 


Translation table walk disable for translations using TTBRO_EL1. Controls whether a translation table walk is 
performed on a TLB miss for an address that is translated using TTBRO_EL1. The possible values are: 


e Perform translation table walk using TTBRO_EL1. 


1 A TLB miss on an address translated from TTBRO_EL1 generates a Translation fault. No translation 
table walk is performed. 





Reserved, RESO. 





[5:0] 








TOSZ 





Size offset of the memory region addressed by TTBRO_EL1. The region size is 2419S) bytes. 








4.3.56 


To access the TCR_EL1: 


MRS <Xt>, TCR_EL1 ; Read TCR_EL1 into Xt 
MSR TCR_EL1, <Xt> ; Write Xt to TCR_EL1 


Translation Control Register, EL2 


The TCR_EL2 characteristics are: 
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4 System Control 
4.3 AArch64 register descriptions 


Purpose Controls translation table walks required for stage | translation of a memory access 
from EL2 and holds cacheability and shareability information. 
TCR_EL2 is part of: 
e The Virtual memory control registers functional group. 
¢ The Hypervisor and virtualization registers functional group. 


Usage This register is accessible as follows: 
constraints 





ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - - RW | RW RW 























Configurations = TCR_EL2 is architecturally mapped to AArch32 register HCTR. See 4.5.44 Hyp 
Translation Control Register on page 4-280. 


Attributes TCR_EL2 is a 32-bit register. 


The following figure shows the TCR_EL2 bit assignments. 


31 30 24 23 2221201918 161514131211109 8 7 6 5 





L_pRes1 L—res1 | lL reso L_IRGNO 
TBI ORGNO 
Figure 4-47 TCR_EL2 bit assignments 


The following table shows the TCR_EL2 bit assignments. 


Table 4-94 TCR_EL2 bit assignments 


















































Bits |Name | Function 
[31] - Reserved, RES1. 
[30:24] | - Reserved, RESO. 
[23] - Reserved, RES1. 
[22:21] | - Reserved, RESO. 
[20] TBI Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. The possible 
values are: 
e Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[19] - Reserved, RESO. 
[18:16] | PS Physical address size. The possible values are: 
Q@beee 32 bits, 4GB. 
b001 36 bits, 64GB. 
@be1e 40 bits, ITB. 
Other values are reserved. 
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4 System Control 
4.3 AArch64 register descriptions 


Table 4-94 TCR_EL2 bit assignments (continued) 





Bits 


Name 


Function 





[15:14] 


TGO 


TTBRO_EL2 granule size. The possible values are: 


Q@bee 4KB. 
Q@be1 64KB. 
@b11 Reserved. 


All other values are not supported. 





[13:12] 


SHO 


Shareability attribute for memory associated with translation table walks using TTBRO_EL2. 
The possible values are: 

@bee Non-shareable. 

@be1 Reserved. 


@b10 Outer shareable. 
0b11 Inner shareable. 





[11:10] 


ORGNO 


Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL2. The possible 
values are: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] 


IRGNO 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL2. The possible 
values are: 


e@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 





[7:6] 





Reserved, RESO. 





[5:0] 








TOSZ 





Size offset of the memory region addressed by TTBRO_EL2. The region size is 2*T9S2) bytes. 








4.3.57 


To access the TCR_EL2: 


MRS <Xt>, TCR_EL2 ; Read EL2 Translation Control Register 
MSR TCR_EL2, <Xt> ; Write EL2 Translation Control Register 


Virtualization Translation Control Register, EL2 


The VTCR_EL2 characteristics are: 


Purpose Controls the translation table walks required for the stage 2 translation of memory 
accesses from Non-secure ELO and EL1, and holds cacheability and shareability 
information for the accesses. 
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Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Any of the bits in VTCR_EL2 are permitted to be cached in a TLB. 


Configurations ©VTCR_EL2 is architecturally mapped to AArch32 register VTCR. See 4.5.45 


Virtualization Translation Control Register on page 4-282. 


Attributes VTCR_EL2 is a 32-bit register. 


The following figure shows the VTCR_EL2 bit assignments. 


31 30 191817161514131211109 8 7 6 5 


L ReEs1 


The following table shows the VTCR_EL2 bit assignments. 


ORGNO = | 
st | 


Figure 4-48 VTCR_EL2 bit assignments 


Table 4-95 VTCR_EL2 bit assignments 





Bits 


Name 


Function 





[31] 


Reserved, RES1. 





[30:19] 





Reserved, RES0. 





[18:16] 


PS 


Physical Address Size. The possible values are: 
Ob00O 32 bits, 4GB. 

Ob001 36 bits, 64GB. 

b010 40 bits, 1TB. 


All other values are reserved. 





[15:14] 


TGO 


Granule size for the corresponding VTTBR_EL2. 


Q@bee 4KB. 
Q@be1 64KB. 
0b11 Reserved. 


All other values are not supported. 





[13:12] 








SHO 





Shareability attribute for memory associated with translation table walks using VTTBR_EL2. 


@bee Non-shareable. 
@be1 Reserved. 

0b10 Outer Shareable. 
0b11 Inner Shareable. 
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4.3 AArch64 register descriptions 


Table 4-95 VTCR_EL2 bit assignments (continued) 





Bits 


Name 


Function 





[11:10] 


ORGNO 


Outer cacheability attribute for memory associated with translation table walks using VTTBR_EL2. 
@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Cacheable. 

0b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] 


IRGNO 


Inner cacheability attribute for memory associated with translation table walks using VTTBR_EL2. 
@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 





[7:6] 


SLO 


Starting level of the VTCR_EL2 addressed region. 





[5:0] 








TOSZ 





The size offset of the memory region addressed by VTTBR_EL2. The region size is 2*1°SZ) bytes. 








4.3.58 


To access the VTCR_EL2: 


MRS <Xt>, VTCR_EL2 ; Read VTCR_EL2 into Xt 
MSR VTCR_EL2, <Xt> ; Write Xt to VTCR_EL2 


Domain Access Control Register 


The DACR32_EL2 characteristics are: 


Purpose Allows access to the AArch32 DACR register from AArch64 state only. Its value 
has no effect on execution in AArch64 state. 


Usage constraints This register is accessible as follows: 





ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - - RW | RW RW 























Configurations © DACR32_EL2 is architecturally mapped to AArch32 register DACR (NS). See 
4.5.46 Domain Access Control Register on page 4-283. 


Attributes DACR32_EL2 is a 32-bit register. 


The following figure shows the DACR32_EL2 bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 161514131211109 8 76543 2 1 





Figure 4-49 DACR32_EL2 bit assignments 


The following table shows the DACR32_EL2 bit assignments. 
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4.3 AArch64 register descriptions 


Table 4-96 DACR32_EL2 bit assignments 





Bits |Name Function 





[31:0] | D<n>, bits [2n+1:2n], for | Domain n access permission, where n = 0 to 15. Permitted values are: 


a TS @be@e No access. Any access to the domain generates a Domain fault. 
@b@1 Client. Accesses are checked against the permission bits in the translation tables. 


@b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value @b1@ is reserved. 














To access the DACR32_EL2: 


MRS <Xt>, DACR32_EL2 ; Read DACR32_EL2 into Xt 
MSR DACR32_EL2, <Xt> ; Write Xt to DACR32_EL2 


4.3.59 Translation Table Base Register 0, EL3 
The TTBRO_EL3 characteristics are: 


Purpose Holds the base address of the translation table for the stage 1 translation of memory 
accesses from EL3. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
2 |e |e fe || RW RW 























Configurations © TTBRO_EL3 is mapped to AArch32 register TTBRO (S). See 4.5.4/ Translation 
Table Base Register 0 on page 4-272. 


Attributes TTBRO_EL3 is a 64-bit register. 


The following figure shows the TTBRO_EL3 bit assignments. 
63 48 47 0 


RESO BADDR[47:x] 


Figure 4-50 TTBRO_EL3 bit assignments 
The following table shows the TTBRO_EL3 bit assignments. 


Table 4-97 TTBRO_EL3 bit assignments 





Bits Name Function 





[63:48] | - Reserved, RESO. 





[47:0] | BADDR[47:x] | Translation table base address, bits[47:x]. Bits [x-1:0] are RESO. 
x is based on the value of TCR_EL1.TOSZ, the stage of translation, and the memory translation granule size. 


For instructions on how to calculate it, see the ARM” Architecture Reference Manual ARMV8, for ARMv8-A 


architecture profile. 
The value of x determines the required alignment of the translation table, that must be aligned to 2* bytes. 


If bits [x-1:0] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:0] are treated as if all the bits are zero. The value read back 
from those bits is the value written. 
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To access the TTBRO_EL3: 


MRS <Xt>, TTBR@_EL3 ; Read TTBR@_EL3 into Xt 
MSR TTBR@_EL3, <Xt> ; Write Xt to TTBR@_EL3 










































































4.3.60 Translation Control Register, EL3 
The TCR_EL3 characteristics are: 
Purpose Controls translation table walks required for stage 1 translation of memory accesses 
from EL3 and holds cacheability and shareability information for the accesses. 
TCR_EL3 is part of the Virtual memory control registers functional group. 
Usage constraints This register is accessible as follows: 
ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
zie - eee [RW RW 
Configurations TCR_EL3 is mapped to AArch32 register TTBR(S). 
Attributes TCR_EL3 is a 32-bit register. 
The following figure shows the TCR_EL3 bit assignments. 
31 30 24:23 22 21 20:19 18 16:15 14 131211109 87 6 5 0 
Figure 4-51 TCR_EL3 bit assignments 
The following table shows the TCR_EL3 bit assignments. 
Table 4-98 TCR_EL3 bit assignments 
Bits |Name | Function 
[31] - Reserved, RES1. 
[30:24] | - Reserved, RESO. 
[23] - Reserved, RES1. 
[22:21] | - Reserved, RESO. 
[20] TBI Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. 
The possible values are: 
e Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
The reset value is 9. 
[19] - Reserved, RESO. 
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4.3 AArch64 register descriptions 


Table 4-98 TCR_EL3 bit assignments (continued) 





Bits 


Name 


Function 





[18:16] 


PS 


Physical address size. The possible values are: 


@beee@ 32 bits, 4GB. 
Qbee1 36 bits, 64GB. 
b010 40 bits, 1TB. 


Other values are reserved. 


The reset value is 0b000. 





[15:14] 


TGO 


TTBRO_EL3 granule size. The possible values are: 


Q@bee 4KB. 
Q@be1 64KB. 
0b11 Reserved. 


All other values are not supported. 


The reset value is b00. 





[13:12] 


SHO 


Shareability attribute for memory associated with translation table walks using TTBRO_EL3. 
The possible values are: 

e@bee Non-shareable. 

@be1 Reserved. 

0b10 Outer shareable. 

0b11 Inner shareable. 


The reset value is b00. 





[11:10] 


ORGNO 


Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL3. 


The possible values are: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


The reset value is @b@0. 





[9:8] 


IRGNO 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL3. 


The possible values are: 


ebee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Inner Write-Through Cacheable. 

0b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


The reset value is @b@@. 





[7:6] 


Reserved, RESO. 





[5:0] 








TOSZ 





Size offset of the memory region addressed by TTBRO_EL3. The region size is 2°+1S2) bytes. 


The reset value is @Bb00000. 
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To access the TCR_EL3: 


MRS <Xt>, TCR_EL3 ; Read EL3 Translation Control Register 
MRS TCR_EL3, <Xt> ; Read EL3 Translation Control Register 


4.3.61 Auxiliary Memory Attribute Indirection Register, EL1, EL2 and EL3 


The processor does not implement AMAIR_EL1, AMAIR EL2 and AMAIR EL3, therefore these 
registers are always RESO. 


4.3.62 Auxiliary Fault Status Register 0, EL1, EL2 and EL3 


The processor does not implement AFSRO_EL1, AFSRO EL2 and AFSRO_EL3, therefore these registers 
are always RESO. 


4.3.63 Auxiliary Fault Status Register 1, EL1, EL2 and EL3 


The processor does not implement AFSR1_EL1, AFSR1_EL2 and AFSR1_EL3, therefore these registers 
are always RESO. 


4.3.64 Exception Syndrome Register, EL1 
The ESR_EL1 characteristics are: 








Purpose Holds syndrome information for an exception taken to EL1. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 























Configurations ESR _ ELI is architecturally mapped to AArch32 register DFSR (NS). See 
4.5.49 Data Fault Status Register on page 4-287. 


Attributes ESR_EL] is a 32-bit register. 


The following figure shows the ESR_EL1 bit assignments. 


31 26 25 24 23 0 


L ISS Valid 
IL 


Figure 4-52 ESR_EL1 bit assignments 
The following table shows the ESR_EL1 bit assignments. 
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Table 4-99 ESR_EL1 bit assignments 





Bits Name Function 








[31:26] | EC Exception Class. Indicates the reason for the exception that this register holds information about. 
[25] IL Instruction Length for synchronous exceptions. The possible values are: 

@ 16-bit. 

1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer misalignment, data aborts 
for which the ISV bit is 0, exceptions caused by an illegal instruction set state, and exceptions using the 0x00 
Exception Class. 





[24] ISS Valid | Syndrome valid. The possible values are: 

















(2) ISS not valid, ISS is RESO. 
1 ISS valid. 
[23:0] |ISS Syndrome information. 





When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 
IMPLEMENTATION DEFINED. The following table shows the definition of the ISS field contents for the Cortex- 
A73 processor. 


Table 4-100 ISS field contents for the Cortex-A73 processor 




















ISS[23:22] | ISS[1:0] | Description 

e@bee e@bee DECERR on external access 

e@bee @be1 Double-bit error detected on dirty line in L2 cache 
e@bee 0b10 SLVERR on external access 

@be1 ebee nSEI, or nVSEI in a guest OS, asserted 

@be1 @be1 nREI asserted 




















Note 
ISS is not valid when a virtual SError is generated on a Guest OS using the HCR_EL2.VSE bit. 





To access the ESR_EL1: 


MRS <Xt>, ESR_EL1 ; Read EL1 Exception Syndrome Register 
MSR ESR_EL1, <Xt> ; Write EL1 Exception Syndrome Register 


4.3.65 Instruction Fault Status Register, EL2 
The IFSR32_EL2 characteristics are: 


Purpose Allows access to the AArch32 IFSR register from AArch64 state only. Its value has 
no effect on execution in AArch64 state. 


Usage constraints This register is accessible as follows: 
































ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- J- | Rw [RW RW 
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Configurations IFSR32_EL2 is architecturally mapped to AArch32 register IFSR(NS). See 
4.5.50 Instruction Fault Status Register on page 4-291. 


Attributes IFSR32_EL2 is a 32-bit register. 


There are two formats for this register. The current translation table format determines which format of 
the register is used. This section describes: 


e JIFSR when using the Short-descriptor translation table format on page 4-291. 
e IFSR when using the Long-descriptor translation table format on page 4-292. 


IFSR32_EL2 when using the Short-descriptor translation table format 


The following figure shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


31 131211109 8 4 


3 0 


ExT— L_ LPAE 
RESO FS[4] 


Figure 4-53 IFSR32_EL2 bit assignments for Short-descriptor translation table format 


The following table shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


Table 4-101 IFSR32_EL2 bit assignments for Short-descriptor translation table format 





Bits 


Name 


Function 





[31:13] 


Reserved, RESO. 





[12] 


ExT 


External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 


Q External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11] 


Reserved, RESO. 





[10] 


Part of the Fault Status field. See bits [3:0] in this table. 





[9] 











On taking a Data Abort exception, this bit is set as follows: 
© Using the Short-descriptor translation table formats. 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 
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Table 4-101 IFSR32_EL2 bit assignments for Short-descriptor translation table format (continued) 











Bits Name | Function 
[8:4] - Reserved, RESO. 
[3:0] FS[3:0] | Fault Status bits. This field indicates the type of exception generated. Interpreted with bit [10]. Any encoding not 
listed is reserved. 
@beee10 Debug event. 
@beee11 Access flag fault, section. 
6bee101 Translation fault, section. 
@bee110 Access flag fault, page. 
@bee111 Translation fault, page. 
0b01000 Synchronous external abort, non-translation. 
6be1001 Domain fault, section. 
Qb01011 Domain fault, page. 
0b01100 Synchronous external abort on translation table walk, first level. 
0b01101 Permission Fault, Section. 
0b01110 Synchronous external abort on translation table walk, second Level. 
0b01111 Permission fault, page. 
0b10000 TLB conflict abort. 
0b11001 Synchronous parity error on memory access. 
@b11100 Synchronous parity error on translation table walk, first level. 
0b11110 Synchronous parity error on translation table walk, second level. 

















IFSR32_EL2 when using the Long-descriptor translation table format 


The following figure shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 


31 131211109 8 6 


5 0 
| frm se | see | 
L_LpaE 
ExT 


Figure 4-54 IFSR32_EL2 bit assignments for Long-descriptor translation table format 


The following table shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 
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Table 4-102 IFSR32_EL2 bit assignments for Long-descriptor translation table format 





Bits 


Name 


Function 





[31:13] 


Reserved, RESO. 





[12] 


ExT 


External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 


(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11:10] 


Reserved, RESO. 





[9] 


LPAE 


On taking a Data Abort exception, this bit is set as follows: 


© Using the Short-descriptor translation table formats. 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 





[8:6] 


Reserved, RESO. 





[5:0] 








Status 





Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is reserved. 


@beeee0ee = Address size fault in TTBRO or TTBRI. 

@bee01LL Translation fault, LL bits indicate level. 

@b@01@LL Access fault flag, LL bits indicate level. 

@be011LL Permission fault, LL bits indicate level. 

0b010009 Synchronous external abort. 

@b@101LL Synchronous external abort on translation table walk, LL bits indicate level. 
@b@1100@@ Synchronous parity error on memory access. 

@b@111LL Synchronous parity error on memory access on translation table walk, LL bits indicate level. 
@b10e0001 Alignment fault. 

@b100010 Debug event. 

0b110009 TLB conflict abort. 








The following table shows how the LL bits in the Status field encode the lookup level associated with the 
MMU fault. 


Table 4-103 Encodings of LL bits associated with the MMU fault 





Bits | Meaning 





@b@O | Reserved 





Qb@1 | Level 1 





Qb10 | Level 2 





0b11 | Level 3 














Note 


If a Data Abort exception is generated by an instruction cache maintenance operation when the Long- 
descriptor translation table format is selected, the fault is reported as a Cache Maintenance fault in the 
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DFSR or HSR with the appropriate Fault Status code. For such exceptions reported in the DFSR, the 
corresponding IFSR32_EL2 is UNKNOWN. 





To access the IFSR32_EL2: 


MRS <Xt>, IFSR32_EL2 ; Read IFSR32_EL2 into Xt 
MSR IFSR32_EL2, <Xt> ; Write Xt to IFSR32_EL2 


Register access is encoded as follows: 


Table 4-104 IFSR32_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 











11 | 000 | 0101 ) 0000 | 001 














4.3.66 Exception Syndrome Register, EL2 
The ESR_EL2 characteristics are: 








Purpose Holds syndrome information for an exception taken to EL2. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Configurations ESR EL2 is architecturally mapped to AArch32 register HSR. See 4.5.55 Hyp 
Syndrome Register on page 4-294. 


Attributes ESR_EL2 is a 32-bit register. 


The following figure shows the ESR_EL2 bit assignments. 


31 26 25 24 0 
L- IL 


Figure 4-55 ESR_EL2 bit assignments 
The following table shows the ESR_EL2 bit assignments. 


Table 4-105 ESR_EL2 bit assignments 





Bits Name | Function 








[31:26] | EC Exception Class. Indicates the reason for the exception that this register holds information about. 
[25] IL Instruction Length for synchronous exceptions. The possible values are: 

e 16-bit. 

1 32-bit. 








[24:0] | ISS Syndrome information. 
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When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 
IMPLEMENTATION DEFINED. The following table shows the definition of the ISS field contents for the Cortex- 
A73 processor. 


Table 4-106 ISS field contents for the Cortex-A73 processor 




















ISS[23:22] | ISS[1:0] | Description 

@bee e@bee DECERR on external access 

@bee @be1 Double-bit error detected on dirty line in L2 cache 
e@bee 0b10 SLVERR on external access 

Qbe1 @bee nSEI or nVSEI in a guest OS, asserted 

@be1 @be1 nREI asserted 




















Note 
ISS is not valid when a virtual SError is generated on a Guest OS using the HCR_EL2.VSE bit. 





To access the ESR_EL2: 


MRS <Xt>, ESR_EL2 ; Read EL1 Exception Syndrome Register 
MSR ESR_EL2, <Xt> ; Write EL1 Exception Syndrome Register 


4.3.67 Exception Syndrome Register, EL3 
The ESR_EL3 characteristics are: 


Purpose Holds syndrome information for an exception taken to EL3. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
» |» |e je RW RW 























Configurations ESR EL3 is mapped to AArch32 register DFSR(S). See 4.5.49 Data Fault Status 
Register on page 4-287. 


Attributes ESR_EL3 is a 32-bit register. 


The following figure shows the ESR_EL3 bit assignments. 


31 26 25 24 23 0 


L ISS Valid 
IL 


The following table shows the ESR_EL3 bit assignments. 


Figure 4-56 ESR_EL3 bit assignments 
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Table 4-107 ESR_EL3 bit assignments 





Bits Name Function 








[31:26] | EC Exception Class. Indicates the reason for the exception that this register holds information about. 
[25] IL Instruction Length for synchronous exceptions. The possible values are: 

@ 16-bit. 

1 32-bit. 


This field is 1 for the SError interrupt, instruction aborts, misaligned PC, Stack pointer misalignment, data aborts 
for which the ISV bit is 0, exceptions caused by an illegal instruction set state, and exceptions using the 0x0 
Exception Class. 





[24] ISS Valid | Syndrome valid. The possible values are: 

















(2) ISS not valid, ISS is RES0. 
1 ISS valid. 
[23:0] | ISS Syndrome information. 





When the EC field is @x2F, indicating an SError interrupt has occurred, the ISS field contents are 
IMPLEMENTATION DEFINED. The following table shows the definition of the ISS field contents for the Cortex- 
A73 processor. 


Table 4-108 ISS field contents for the Cortex-A73 processor 




















ISS[23:22] | ISS[1:0] | Description 

e@bee e@bee DECERR on external access 

e@bee @be1 Double-bit error detected on dirty line in L2 cache 
e@bee 0b10 SLVERR on external access 

@be1 ebee nSEI, or nVSEI in a guest OS, asserted 

@be1 @be1 nREI asserted 




















Note 
ISS is not valid when a virtual SError is generated on a Guest OS using the HCR_EL2.VSE bit. 





To access the ESR_EL3: 


MRS <Xt>, ESR_EL3 ; Read EL3 Exception Syndrome Register 
MSR ESR_EL3, <Xt> ; Write EL3 Exception Syndrome Register 


4.3.68 Fault Address Register, EL1 
The FAR ELI characteristics are: 
































Purpose Holds the faulting Virtual Address for all synchronous instruction or data aborts, or 
exceptions from a misaligned PC or a Watchpoint debug event, taken to EL1. 
Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW |RW RW 
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Configurations FAR EL1[31:0] is architecturally mapped to AArch32 register DFAR (NS). See 
4.5.56 Data Fault Address Register on page 4-295. 


FAR_EL1[63:32] is architecturally mapped to AArch32 register IFAR (NS). See 
4.5.57 Instruction Fault Address Register on page 4-296. 


Attributes FAR_ELI is a 64-bit register. 
The following figure shows the FAR EL]! bit assignments. 


63 0 


Figure 4-57 FAR_EL1 bit assignments 
The following table shows the FAR_EL1 bit assignments. 


Table 4-109 FAR_EL1 bit assignments 





Bits | Name | Function 





[63:0] | VA The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from a misaligned PC, 
taken in EL1. 


If a memory fault that sets the FAR is generated from one of the data cache instructions, this field holds the address 





specified in the register argument of the instruction. 














To access the FAR _EL1: 


MRS <Xt>, FAR_EL1 ; Read EL1 Fault Address Register 
MSR FAR_EL1, <Xt> ; Write EL1 Fault Address Register 


4.3.69 Fault Address Register, EL2 
The FAR _EL2 characteristics are: 








Purpose Holds the faulting Virtual Address for all synchronous instruction or data aborts, or 
exceptions from a misaligned PC or a Watchpoint debug event, taken to EL2. 
Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Configurations FAR EL2[31:0] is architecturally mapped to AArch32 registers: 
e HDFAR. See 4.5.58 Hyp Data Fault Address Register on page 4-297. 
e DFAR (S). See 4.5.56 Data Fault Address Register on page 4-295. 


FAR_EL2[63:32] is architecturally mapped to AArch32 registers: 
¢ HIFAR. See 4.5.59 Hyp Instruction Fault Address Register on page 4-298. 
e IFAR (S). See 4.5.57 Instruction Fault Address Register on page 4-296. 


Attributes FAR_EL2 is a 64-bit register. 


The following figure shows the FAR_EL2 bit assignments. 
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63 0 


Figure 4-58 FAR_EL2 bit assignments 


The following table shows the FAR_EL2 bit assignments. 
Table 4-110 FAR_EL2 bit assignments 


Bits | Name | Function 





[63:0] | VA The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from a misaligned PC, 
taken in EL2. 

If a memory fault that sets the FAR is generated from one of the data cache instructions, this field holds the address 
specified in the register argument of the instruction. 














To access the FAR_EL2: 


MRS <Xt>, FAR_EL2 ; Read EL2 Fault Address Register 
MSR FAR_EL2, <Xt> ; Write EL2 Fault Address Register 


4.3.70 Hypervisor IPA Fault Address Register, EL2 
The HPFAR_EL2 characteristics are: 








Purpose Holds the faulting IPA for some aborts on a stage 2 translation taken to EL2. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Configurations © HPFAR_EL2[31:0] is mapped to AArch32 register HPFAR. See 4.5.60 Hyp IPA 
Fault Address Register on page 4-299. 


Attributes HPFAR_EL2 is a 64-bit register. 


The following figure shows the HPFAR_EL2 bit assignments. 


63 40 39 43 0 


RESO FIPA[47:12] RESO 


Figure 4-59 HPFAR_EL2 bit assignments 





The following table shows the HPFAR_EL2 bit assignments. 
Table 4-111 HPFAR_EL2 bit assignments 





Bits Name Function 





[63:40] | - Reserved, RESO. 





[39:4] | FIPA[47:12] | Bits [47:12] of the faulting intermediate physical address. The equivalent upper bits in this field are RESO. 

















[3:0] - Reserved, RESO. 
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To access the HPFAR_EL2: 


MRS <Xt>, HPFAR_EL2 ; Read EL2 Fault Address Register 
MSR HPFAR_EL2, <Xt> ; Write EL2 Fault Address Register 


4.3.71 L2 Control Register 
The L2CTLR_ELI characteristics are: 





























Purpose Provides IMPLEMENTATION DEFINED control options for the L2 memory system. 
Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 
Note 


This register is write accessible in EL] if: 

e ACTLR_EL3.EN L2CTLR is | and 

e ACTLR_EL2.EN L2CTLR is 1 or ACTLR_EL3.EN EN L2CTLR is 1 and 
e SCR.NS is 0. 


If write access is not possible, then L2CTLR_ELI is trapped to the lowest exception 
level that denied access (EL2 or EL3). 





Configurations ©L2CTLR_ELI is architecturally mapped to the AArch32 L2CTLR register. See 
4.5.62 L2 Control Register on page 4-299.: 


There is one L2CTLR_ELI for all cores in the Cortex-A73 processor. 
Attributes L2CTLR_ELI is a 32-bit register. 


The following figure shows the L2CTLR_EL1 bit assignments. 


31 30 2726 25 24 2322 2120191817 1514 1211 98 65 3 2 0 








RESO L2 tag RAM write latency 











L2 prefetcher full mode disable 
L2 prefetcher disable 

L2 evict disable 

L2 ECC disable 


L2 tag RAM read latency 
L2 tag RAM setup latency 
L2 data cache disable 














Monitor L2RSTDISABLE— LL2 data RAM write latency 
RESO L2 data RAM read latency 
Number of cores L2 data RAM setup latency 





Figure 4-60 L2CTLR_EL1 bit assignments 
The following table shows the L2CTLR_EL1 bit assignments. 
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Table 4-112 L2CTLR_EL1 bit assignments 











Bits Name Function 
[31] L2RSTDISABLE Monitor L2RSTDISABLE. 
[30:27] | Flush index increment L2 cache clean and clean and invalidate all operations loop on all ways and on all sets. Each 


set is referenced by an index. These operations evict cache lines marked as dirty. This 
corresponds to the cache cleaning algorithm specified in the ARM® Architecture Reference 
Manual ARMV8, for ARMv8-A architecture profile. 


The Flush index increment field controls how the index increments. The reset value @b0000 
gives an increment of 1, this evicts dirty lines on index 0,1,2,3,4,5, ... (modulo the total 
number of sets). Setting the field to 060100 gives an increment value 15, which evicts dirty 
lines on index 0,15,30,45, ... (modulo the total number of sets). 


@beeee 1. This is the reset value. 
@beee1 1. 
@bee10 3. 
@bee11 7. 
@be100 15. 
@be0101 31. 
0b0110 63. 

an (2^n)-1. 
0b1100 4095. 
0b1101 8191. 
0b1110 8191. 
0b1111 8191. 


You can program the flush index increment field to optimize cache flush speed for system 
configuration of address decode supporting a complex multi-channel multi-rank memory 








system. 

[26] - Reserved, RESO. 

[25:24] | Number of cores Number of cores present: 
@bee One core, core 0. 
@be1 Two cores, core 0 and core 1. 
@b10 Three cores, cores 0 to 2. 
0b11 Four cores, cores 0 to 3. 


These bits are read-only and the value of this field is set to the number of cores present in the 
configuration. 





[23] - Reserved, RESO. 





[22] L2 prefetcher full mode Disables the full mode of the L2 prefetcher: 


disable o Enables full mode. 


1 Disables full mode. 


The reset value is 0. 
Note 
This bit has no effect when the L2 prefetcher disable bit is set to 1. 
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Table 4-112 L2CTLR_EL1 bit assignments (continued) 





Bits 


Name 


Function 





[21] 


L2 prefetcher disable 


Disables the L2 prefetcher: 


7) Enables prefetcher. 
1 Disables prefetcher. 


The reset value is 0. 





[20] 


L2 evict disable 


Disables evict information sent to interconnect: 


(2) Enables evict information. 


1 Disables evict information. 


The reset value is 0. 





[19] 


L2 ECC disable 


Disables L2 ECC protection: 


e Enables ECC protection. 
1 Disables ECC protection. 


The reset value is 0. 





[18] 


L2 data cache disable?! 


Disables L2 data cache: 


(2) Enables L2 data cache. 
1 Disables L2 data cache. 


The reset value is 0. 





[17:15] 


L2 tag RAM setup latency 


L2 tag RAM setup latency: 


<n> <n+1>-cycle setup delay from L2 tag RAMs. 





[14:12] 


L2 tag RAM read latency 


L2 tag RAM read latency: 


<n> <n+1>-cycle read delay from L2 tag RAMs. 





[11:9] 


L2 tag RAM write latency 


L2 tag RAM write latency: 


<n> <n+1>-cycle write delay from L2 tag RAMs. 





[8:6] 


L2 data RAM setup latency 


L2 data RAM setup latency: 


<n> <n+1>-cycle setup delay from L2 data RAMs. 





L2 data RAM read latency 


L2 data RAM read latency: 


<n> <n+1>-cycle read delay from L2 data RAMs. 








[2:0] 








L2 data RAM write latency 





L2 data RAM write latency: 


<n> <n+1>-cycle write delay from L2 data RAMs. 








To access the L2CTLR_EL1: 


MRS <Xt>, S3_1_C11 C@ 2 ; Read L2CTLR_EL1 into Xt 
MSR $3.1 C11 C@ 2, <Xt>; Write Xt to L2CTLR_EL1 





ad The L2 cache must never be disabled in a multi-cluster configuration. 
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4.3.72 L2 Extended Control Register 
The LZECTLR_ELI characteristics are: 


Purpose Provides additional IMPLEMENTATION DEFINED control options for the L2 memory 
system. This register is used for dynamically changing, but implementation specific, 
control bits. 








Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 























The LZECTLR_ELI can be written dynamically. 
Note 

This register is write accessible in EL] if: 

e ACTLR_EL3.EN L2CTLR is 1 and 


e ACTLR_EL2.EN EN L2CTLR is 1 or ACTLR_EL3.EN EN L2CTLR is 1 and 
e SCR.NS is 0. 





If write access is not possible, then LZECTLR_EL] is trapped to the lowest exception 
level that denied access (EL2 or EL3). 





Configurations L2ECTLR_ ELI is architecturally mapped to the AArch32 L2ZECTLR register. See 
4.5.63 L2 Extended Control Register on page 4-302. 


There is one copy of this register that is used in both Secure and Non-secure states. 
There is only one LZECTLR_ELI for all cores in the Cortex-A73 processor. 
Attributes L2ECTLR_EL] is a 32-bit register. 


The following figure shows the LAECTLR_EL1 bit assignments. 


31 30 29 28 543 2 1 0 


LAXI asynchronous error L2 light sleep mode delay- 
L2 RAM Double-Bit ECC error L2 dynamic retention control 
RESO 


Figure 4-61 L2ZECTLR_EL1 bit assignments 
The following table shows the LZECTLR_EL1 bit assignments. 


Table 4-113 L2ECTLR_EL1 bit assignments 





Bits |Name Function 





[B1] l- Reserved, RESO. 





[80] | L2 RAM Double-Bit | L2 RAM Double-Bit ECC error indication. The possible values are: 




















ECC ae e No pending Double-Bit ECC error. 
1 A fatal Double-Bit ECC error has occurred. 
A write of 0 clears this bit. A write of 1 is ignored. 
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Table 4-113 L2ECTLR_EL1 bit assignments (continued) 





Bits 


Name 


Function 





[29] 


AXI asynchronous 
error 


AXI asynchronous error indication. The possible values are: 
(2) No pending asynchronous error. 


1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 





[28:5] 


Reserved, RESO. 





[4:3] 


L2 light sleep mode 
delay 


L2 light sleep mode delay. The possible values are: 
@bee 
@be1 
@b10 
@b11 


0 clock cycles before L2 RAM enters sleep mode. 

16 clock cycles before L2 RAM enters sleep mode. 
32 clock cycles before L2 RAM enters sleep mode. 
64 clock cycles before L2 RAM enters sleep mode. 





[2:0] 








L2 dynamic retention 
control 





L2 Data dynamic retention control. The possible values are: 


ebeee 
@bee1 
0be10 
0b011 
0b100 
0b101 
0b110 
0b111 


L2 dynamic retention disabled. This is the reset value. 
2 Generic Timer ticks required before retention entry. 

8 Generic Timer ticks required before retention entry. 
32 Generic Timer ticks required before retention entry. 
64 Generic Timer ticks required before retention entry. 
128 Generic Timer ticks required before retention entry. 
256 Generic Timer ticks required before retention entry. 


512 Generic Timer ticks required before retention entry. 





Note 


If the CNTVALUEB[63:0] bus increments by more than 1024, this bit is not taken into account and 


the retention entry may never occur. 











4.3.73 


To access the LAECTLR_EL1: 


MRS Rt, S3_1_C11_C@_3; Read L2ECTLR_EL1 into Rt 
MSR S31 C11 C@_3, Rt; Write Rt to L2ECTLR_EL1 


Fault Address Register, EL3 
The FAR_EL3 characteristics are: 


Purpose 


Holds the faulting Virtual Address for all synchronous instruction or data aborts, or 


exceptions from a misaligned PC, taken to EL3. 


Usage constraints This register is accessible as follows: 


ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - - RW RW 
Configurations There is no additional configuration data for FAR_EL3. 
Attributes FAR_EL3 is a 64-bit register. 
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The following figure shows the FAR_EL3 bit assignments. 
63 0 
Figure 4-62 FAR_EL3 bit assignments 


The following table shows the FAR_EL3 bit assignments. 
Table 4-114 FAR_EL3 bit assignments 


Bits | Name | Function 





[63:0] | VA The faulting Virtual Address for all synchronous instruction or data aborts, or an exception from a misaligned PC, 
taken in EL3. 

If a memory fault that sets the FAR is generated from one of the data cache instructions, this field holds the address 
specified in the register argument of the instruction. 














To access the FAR_EL3: 


MRS <Xt>, FAR_EL3 ; Read EL3 Fault Address Register 
MSR FAR_EL3, <Xt> ; Write EL3 Fault Address Register 


4.3.74 Physical Address Register, EL1 
The PAR ELI characteristics are: 








Purpose The Physical Address returned from an address translation. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW |RW RW 























Configurations PAR ELI is architecturally mapped to AArch32 register PAR(NS). See 
4.5.61 Physical Address Register on page 4-299. 


Attributes PAR_ ELI is a 64-bit register. 


The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion completes successfully. 


63 6059 5655 48 47 1211109 87 6 


RES1 LNs 
RESO 


Figure 4-63 PAR_EL1 pass bit assignments 


The following table shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion completes successfully. 
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Table 4-115 PAR_EL1 pass bit assignments 

































































Bits | Name | Function 
[63:60] | AttrH | Defines Normal or Device memory and outer cacheability. Must be used in conjunction with AttrL. 
See Table 4-117 Attr<n>[7:4] bit assignments on page 4-176. 
[59:56] | AttrL | Defines Device memory, and Inner cacheability. Must be interpreted in conjunction with AttrH. 
See Table 4-118 Attr<n>[3:0] bit assignments on page 4-176. 
[55:48] | - Reserved, RESO. 
[47:12] | PA Physical address. The Physical Address corresponding to the supplied Virtual Address. Returns address bits[47:12]. 
[11] - Reserved, RES1. 
[10] - Reserved, RESO. 
[9] NS Non-secure. The NS attribute for a translation table entry read from Secure state. 
This bit is UNKNOWN for a translation table entry from Non-secure state. 
[8:7] SHA _ | Shareability attribute for the Physical Address returned from a translation table entry. The possible values are: 
@bee Non-shareable. 
@be1 Reserved. 
0b10 Outer Shareable 
0b11 Inner Shareable. 
Note 
Takes the value of b18 for: 
« Any type of device memory. 
e Normal memory with both Inner Non-cacheable and Outer-cacheable attributes. 
[6:1] |- Reserved, RESO. 
[0] F Pass/Fail bit. Indicates whether the conversion completed successfully. This value is: 
© Virtual Address to Physical Address conversion completed successfully. 
The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion is aborted. 
63 1211109 8 7 6 
RESO 
Figure 4-64 PAR_EL1 fail bit assignments 
The following table shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion is aborted. 
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Table 4-116 PAR_EL1 fail bit assignments 





























Bits |Name | Function 

[63:12] | - Reserved, RESO. 

[11] - Reserved, RES1. 

[10] - Reserved, RESO. 

[9] S Stage of fault. Indicates the state where the translation aborted. The possible values are: 
© Translation aborted because of a fault in stage 1 translation. 
1 Translation aborted because of a fault in stage 2 translation. 

[8] PTW | Indicates a stage 2 fault during a stage 1 table walk. The possible values are: 
© Nostage 2 fault during a stage 1 table walk. 
1 ‘Translation aborted because of a stage 2 fault during a stage 1 table walk. 

[7] - Reserved, RESO. 

[6:1] | FST | Fault status code, as shown in the Data Abort ESR encoding. See the ARM® Architecture Reference Manual ARMvé, 
for ARMVv8-A architecture profile for more information. 

[0] F Pass/Fail bit. Indicates whether the conversion completed successfully. This value is: 
1 Virtual Address to Physical Address conversion aborted. 

















ae 


To access the PAR _EL1: 


MRS <Xt>, PAR_EL1 ; Read EL1 Physical Address Register 
MSR PAR_EL1, <Xt> ; Write EL1 Physical Address Register 


4.3.75 Memory Attribute Indirection Register, EL1 
The MAIR ELI characteristics are: 








Purpose Provides the memory attribute encodings corresponding to the possible AttrIndx 
values in a Long-descriptor format translation table entry for stage 1 translations at 
EL1. 
Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 























MAIR _ ELI is permitted to be cached in a TLB. 





ac The transient hint is ignored. 
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Configurations MAIR _EL1[31:0] is architecturally mapped to AArch32 register: 

e PRRR (NS) when TTBCR.EAE is 0. See 4.5.64 Primary Region Remap Register 
on page 4-304. 

e MAIRO (NS) when TTBCR.EAE is 1. See 4.5.65 Memory Attribute Indirection 
Registers 0 and I on page 4-307. 

MAIR EL1[63:32] is architecturally mapped to AArch32 register: 

e NMRR (NS) when TTBCR.EAE is 0. See 4.5.66 Normal Memory Remap 
Register on page 4-309. 

e MAIRI(NS) when TTBCR.EAE is 1. See 4.5.65 Memory Attribute Indirection 
Registers 0 and 1 on page 4-307. 


Attributes MAIR ELI is a 64-bit register. 
The following figure shows the MAIR_ELI bit assignments. 


56:55 48:47 40:39 32:31 24 23 16 15 8 7 
At 


63 0 
Attr7 Attr6 Attr5 Attr4 Attr3 Attr: Attr1 trO 
s$ s$ s$ s$ s$ Sf s$ 


9) 9) 9) 





Figure 4-65 MAIR_EL1 bit assignments 


Attr<n> is the memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format 
translation table entry, where AttrIndx[2:0] gives the value of <n> in Attr<n>. 


The following table shows the encoding of bits [7:4] of the Attr<n> field. 


Table 4-117 Attr<n>[7:4] bit assignments 





Bits Meaning 





0b0000 Device memory. See The following table for the type of Device memory. 





ObOORW, RW not @@ | Normal Memory, Outer Write-through transient.** 





0be100 Normal Memory, Outer Non-Cacheable. 





@b@1RW, RW not 00 | Normal Memory, Outer Write-back transient.* 





@b10RW Normal Memory, Outer Write-through non-transient. 














@b11RW Normal Memory, Outer Write-back non-transient. 














The following table shows the encoding of bits [0:3] of the Attr<n> field. 


Table 4-118 Attr<n>[3:0] bit assignments 























Bits Meaning when Attr<n>[7:4] is 0000 | Meaning when Attr<n>[7:4] is not 0000 

@beeee Device-nGnRnE memory UNPREDICTABLE 

@bOORW, RW not OO | UNPREDICTABLE Normal Memory, Inner Write-through transient 

@be100 Device-nGnRE memory Normal memory, Inner Non-Cacheable 

@bO1RW, RW not OO | UNPREDICTABLE Normal Memory, Inner Write-back transient 

0b1000 Device-nGRE memory Normal Memory, Inner Write-through non-transient (RW=00) 
@b1ORW, RW not 0O | UNPREDICTABLE Normal Memory, Inner Write-through non-transient 


























af The transient hint is ignored. 
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Table 4-118 Attr<n>[3:0] bit assignments (continued) 











Bits Meaning when Attr<n>[7:4] is 0000 | Meaning when Attr<n>[7:4] is not 0000 
0b1100 Device-GRE memory Normal Memory, Inner Write-back non-transient (RW=00) 
@b11RW, RW not 0O | UNPREDICTABLE Normal Memory, Inner Write-back non-transient 














The following table shows the encoding of the R and W bits that are used, in some Attr<n> encodings in 
the previous tables, to define the read-allocate and write-allocate policies: 


Table 4-119 Encoding of R and W bits in some Attr<n> fields 





R or W | Meaning 


























0 Do not allocate 
1 Allocate 
To access the MAIR _ ELI: 
MRS <Xt>, MAIR_EL1 ; Read EL1 Memory Attribute Indirection Register 
MSR MAIR_EL1, <Xt> ; Write EL1 Memory Attribute Indirection Register 
4.3.76 Memory Attribute Indirection Register, EL2 
The MAIR _EL2 characteristics are: 
Purpose Provides the memory attribute encodings corresponding to the possible AttrIndx 
values in a Long-descriptor format translation table entry for stage | translations at 
EL2. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























MAIR _EL2 is permitted to be cached in a TLB. 
Configurations MAIR EL2[31:0] is architecturally mapped to AArch32 register HMAIRO. 
MAIR_EL2[63:32] is architecturally mapped to AArch32 register HMAIRI. 
Attributes MAIR EL2 is a 64-bit register. 


The MAIR _EL2 bit assignments follow the same pattern as described in 4.3.75 Memory Attribute 
Indirection Register, ELI on page 4-175. 


The description of the MAIR_EL2 bit assignments are the same as described in 4.3.75 Memory Attribute 
Indirection Register, EL] on page 4-175. 


To access the MAIR_EL2: 


MRS <Xt>, MAIR_EL2 ; Read EL2 Memory Attribute Indirection Register 
MSR MAIR_EL2, <Xt> ; Write EL2 Memory Attribute Indirection Register 


4.3.77 Memory Attribute Indirection Register, EL3 
The MAIR EL3 characteristics are: 





Purpose Provides the memory attribute encodings corresponding to the possible AttrIndx 
values in a Long-descriptor format translation table entry for stage 1 translations at 
EL3. 
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ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - - RW RW 











MAIR EL3 is a 64-bit register. 


MAIR EL3 is permitted to be cached in a TLB. 


MAIR _ EL3[31:0] is mapped to AArch32 register PRRR (S) when TTBCR.EAE is 0. 
See 4.5.64 Primary Region Remap Register on page 4-304. 


The MAIR _EL3 bit assignments follow the same pattern as described in 4.3.75 Memory Attribute 
Indirection Register, ELI on page 4-175. 


MAIR _EL3[63:32] is mapped to AArch32 register NMRR (S) when TTBCR.EAE is 
0. See 4.5.66 Normal Memory Remap Register on page 4-309. 


The description of the MAIR_EL3 bit assignments are the same as described in 4.3.75 Memory Attribute 
Indirection Register, ELI on page 4-175. 


To access the MAIR_EL3: 


MRS <Xt>, MAIR_EL3 ; 


Read EL3 Memory Attribute Indirection Register 


MSR MAIR_EL3, <Xt> ; Write EL3 Memory Attribute Indirection Register 


4.3.78 Vector Base Address Register, EL1 
The VBAR_ ELI characteristics are: 


Purpose 


Holds the exception base address for any exception that is taken to EL1. 


Usage constraints This register is accessible as follows: 


Configurations 


Attributes 























ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW |RW | RW RW 








The VBAR_EL1[31:0] is architecturally mapped to the Non-secure AArch32 
VBAR register. See 4.5.71 Vector Base Address Register on page 4-310. 


VBAR ELI is a 64-bit register. 


The following figure shows the VBAR_ELI bit assignments. 


63 







Vector base address 


The following table shows the VBAR_EL1 bit assignments. 


Figure 4-66 VBAR_EL1 bit assignments 
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Table 4-120 VBAR_EL1 bit assignments 





Bits | Name Function 





[63:5] | Vector base address | Base address of the exception vectors for exceptions taken in this exception level. 














[4:0] |- Reserved, RESO. 





To access the VBAR_ ELI: 


MRS <Xt>, VBAR_EL1 ; Read VBAR_EL1 into Xt 
MSR VBAR_EL1, <Xt> ; Write Xt to VBAR_EL1 


4.3.79 Vector Base Address Register, EL2 
The VBAR_EL2 characteristics are: 








Purpose Holds the exception base address for any exception that is taken to EL2. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW | RW RW 























Configurations The VBAR_EL2[31:0] is architecturally mapped to the AArch32 HVBAR register. 
See 4.5.74 Hyp Vector Base Address Register on page 4-313. 


Attributes VBAR EL2 is a 64-bit register. 


The following figure shows the VBAR_EL2 bit assignments. 


63 5 4 0 







Vector base address 


Figure 4-67 VBAR_EL2 bit assignments 
The following table shows the VBAR_EL2 bit assignments. 


Table 4-121 VBAR_EL2 bit assignments 





Bits | Name Function 





[63:5] | Vector base address | Base address of the exception vectors for exceptions taken in this exception level. 














[4:0] |- Reserved, RESO. 





To access the VBAR_EL2: 


MRS <Xt>, VBAR_EL2 ; Read VBAR_EL2 into Xt 
MSR VBAR_EL2, <Xt> ; Write Xt to VBAR_EL2 


Register access is encoded as follows: 


Table 4-122 VBAR_EL2 access encoding 





op0 | op1 | CRn | CRm | op2 





11 | 100 | 1100 | 0000 | 000 
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4.3.80 Vector Base Address Register, EL3 
The VBAR_EL3 characteristics are: 
Purpose Holds the exception base address for any exception that is taken to EL3. 
Usage constraints This register is accessible as follows: 
ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
$ z - - RW RW 
Attributes VBAR_EL3 is a 64-bit register. 
The following figure shows the VBAR_EL3 bit assignments. 
63 5 4 0 
Vector base address 
Figure 4-68 VBAR_EL3 bit assignments 
The following table shows the VBAR_EL3 bit assignments. 
Table 4-123 VBAR_EL3 bit assignments 
Bits | Name Function 
[63:5] | Vector base address | Base address of the exception vectors for exceptions taken in this exception level. 
[4:0] |- Reserved, RESO. 
To access the VBAR_EL3: 
MRS <Xt>, VBAR_EL3 ; Read EL3 Vector Base Address Register 
MSR VBAR_EL3, <Xt> ; Write EL3 Vector Base Address Register 
4.3.81 Reset Vector Base Address Register, EL3 


The RVBAR_EL3 characteristics are: 


Purpose 
AArch64 state. 


Contains the address that execution starts from after reset when executing in the 


RVBAR EL3 is part of the Reset management registers functional group. 


Usage constraints This register is accessible as follows: 





























ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - - RO RO 
Configurations There is no configuration information. 
Attributes RVBAR EL3 is a 64-bit register. 


The following figure shows the RVBAR_EL3 bit assignments. 
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63 0 


Reset Vector Base Address 
s$ 


Figure 4-69 RVBAR_EL3 bit assignments 





The following table shows the RVBAR_EL3 bit assignments. 


Table 4-124 RVBAR_EL3 bit assignments 





Bits | Name | Function 





[63:0] | RVBA | Reset Vector Base Address. The address that execution starts from after reset when executing in 64-bit state. Bits[1:0] 
of this register are @b@, as this address must be aligned, and bits [63:40] are @x000@000 because the address must be 
within the physical address size supported by the processor. 

















To access the RVBAR_EL3: 


MRS <Xt>, RVBAR_EL3 ; Read RVBAR_EL3 into Xt 


4.3.82 Reset Management Register 
The RMR_EL3 characteristics are: 


Purpose Controls the execution state that the processor boots into and allows request of a 
Warm reset. 


Usage constraints This register is accessible as follows: 








ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
So flee Skee. ee” [RW RW 























Configurations The RMR _EL3 is architecturally mapped to the AArch32 RMR register. 
Attributes RMR _ EL3 is a 32-bit register. 


The following figure shows the RMR_EL3 bit assignments. 
31 210 


mF 
RR— 
AA64 
Figure 4-70 RMR_EL3 bit assignments 
The following table shows the RMR_EL3 bit assignments. 
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Table 4-125 RMR_EL3 bit assignments 



























































Bits | Name | Function 
(31:2] | - Reserved, RESO. 
[1] RR Reset Request. The possible values are: 
© This is the reset value. 
1 Requests a Warm reset. This bit is set to 0 by either a cold or Warm reset. 
The bit is strictly a request. 
[0] AA64 | Determines which execution state the processor boots into after a Warm reset. The possible values are: 
7) AArch32 Execution state. 
1 AArch64 Execution state. 
The reset vector address on reset takes a choice between two values, depending on the value in the AA64 bit. This 
ensures that even with reprogramming of the AA64 bit, it is not possible to change the reset vector to go to a different 
location. 
The Cold reset value depends on the AA64nAA3?2 signal. 
To access the RMR_EL3: 
MRS <Xt>, RMR_EL3 ; Read RMR_EL3 into Xt 
MSR RMR_EL3, <Xt> ; Write Xt to RMR_EL3 
4.3.83 Interrupt Status Register 
The ISR_EL1 characteristics are: 
Purpose Shows whether an IRQ, FIQ, or external abort is pending. An indicated pending 
abort might be a physical abort or a virtual abort. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RO |RO [RO |RO RO 
Configurations ISR_ELI is architecturally mapped to AArch32 register ISR. See 4.5.73 Interrupt 
Status Register on page 4-312. 
Attributes ISR_ELI is a 32-bit register. 
The following figure shows the ISR_EL1 bit assignments. 
31 98765 0 
ee ee 
Figure 4-71 ISR_EL1 bit assignments 
The following table shows the ISR_EL1 bit assignments. 
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Table 4-126 ISR_EL1 bit assignments 

























































































Bits | Name | Function 
[31:9] | - Reserved, RESO. 
[8] A External abort pending bit: 
7) No pending external abort. 
1 An external abort is pending. 
[7] I IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
7) No pending IRQ. 
1 An IRQ interrupt is pending. 
[6] F FIQ pending bit. Indicates whether an FIQ interrupt is pending: 
(2 No pending FIQ. 
1 An FIQ interrupt is pending. 
[5:0] |- Reserved, RESO. 
To access the ISR_EL1: 
MRS <Xt>, ISR_EL1 ; Read ISR_EL1 into Xt 
Register access is encoded as follows: 
Table 4-127 ISR_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 000 | 1100 | 0001 | 000 
4.3.84 Extended Control Register, EL1 
ECTLR_ELI characteristics are: 
Purpose Provides configuration and control options for the L1 and L2 memory systems. 
Usage This register is accessible as follows: 
constraints 
ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 
The ECTLR_ELI can be written dynamically. 
The ECTLR_ELI is write accessible in EL1 if ACTLR_EL3.ECTLR_EN is 1 and 
ACTLR_EL2.ECTLR_EN is 1, or ACTLR_EL3.ECTLR_EN is 1 and SCR.NS is 0. 
The ECTLR_ELI is write accessible in EL2 if ACTLR_EL3.ECTLR is 1. 
Configurations The ECTLR_EL1 is architecturally mapped to the AArch32 ECTLR register. See 
4.5.76 Extended Control Register on page 4-314. 
Attributes ECTLR_ ELI is a 64-bit register. 
The following figure shows the ECTLR_EL1 bit assignments. 
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MMUPF —— 
STXEN 
L2PF 


L1PF 
SMPEN 
CPURETCTL 


Figure 4-72 ECTLR_EL1 bit assignments 


The following table shows the ECTLR_ELI bit assignments. 


Table 4-128 ECTLR_EL1 bit assignments 





Bits 


Name 


Function 





[63:11] 


Reserved, RESO. 





[10] 


MMUPF 


Enables MMU prefetch. The reset value is @b1. 





[9] 


STXEN 


Enables exclusive signaling on the ACE master interface for CleanUnique requests due to cacheable 
Exclusive stores. The reset value is @b@. 





[8] 


L2PF 


Enable L2 prefetch requests sent by the stride prefetcher. The reset value is 0b1. 





[7] 


LIPF 


Enable L1 prefetch requests sent by the stride prefetcher. The reset value is 0b1. 








[6] 


SMPEN 


Enable hardware management of data coherency with other cores in the cluster. The possible values are: 


@ Disables data coherency with other cores in the cluster. This is the reset value. 


1 Enables data coherency with other cores in the cluster. 





Note 


Set the SMPEN bit before enabling the caches, even if there is only one core in the system. 








[5:3] 


Reserved, RESO. 





[2:0] 








CPURETCTL 





CPU retention control. The possible values are: 


ebeee Disable the retention circuit. This is the reset value. 

@bee1 2 Architectural Timer ticks are required before retention entry. 
@be10 8 Architectural Timer ticks are required before retention entry. 
@be11 32 Architectural Timer ticks are required before retention entry. 
@b100 64 Architectural Timer ticks are required before retention entry. 
@b101 128 Architectural Timer ticks are required before retention entry. 
0b110 256 Architectural Timer ticks are required before retention entry. 
0b111 512 Architectural Timer ticks are required before retention entry. 





Note 


If the CNTVALUEB[63:0] bus increments by more than 1024, this bit is not taken into account and the 
retention entry may never occur. 














ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


4-184 


To access the ECTLR_ELI: 


MRS <Xt>, S3_1_C15_C2_1; Read EL1 Extended Control Register 


MSR S3_1_C15_C2_1, <Xt>; Write EL1 Extended Control Register 
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4.3.85 L2 Memory Error Syndrome Register 
The L2MERRSR_ELI characteristics are: 
Purpose Holds information about ECC errors on the: 
e L2 data RAMs. 
e L2 tag RAMs. 
e SCU snoop filter RAMs. 
Usage This register is accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW |RW RW 
Configurations The L2MERRSR ELl is: 
e Mapped to the AArch32 L2MERRSR register. See 4.5.77 L2 Memory Error 
Syndrome Register on page 4-316. 
e There is one copy of this register that is used in both Secure and Non-secure 
states. 
e A write of any value to the register updates the register to 02x10000000. 
Attributes L2MERRSR ELI is a 64-bit register. 
The following figure shows the LAMERRSR_ELI bit assignments. 
63 62 46 45 40 39:38 37 32:31 30 25 24 23 22 21 18 17:1615 32 0 
RESO Other error Repeat eo | fam index = 
count error count re 
L— Fatal Valid — RAMID— 
Figure 4-73 L2MERRSR_EL1 bit assignments 
The following table shows the LIMERRSR_ ELI bit assignments. 
Table 4-129 L2MERRSR_EL1 bit assignments 
Bits /Name Function | 
[63] Fatal Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit so that after it is 
set, it remains set until the register is written. 
The reset value is 0. 
[62:46] | - Reserved, RESO. | 
[45:40] | Other error | This field is set to 0 on the first memory error and is incremented on any memory error that does not match the 
count RAMID and Bank/Way information in this register while the sticky Valid bit is set. 
The reset value is 0. 
[39:38] | - Reserved, RESO. | 
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Table 4-129 L2MERRSR_EL1 bit assignments (continued) 




































































Bits /Name Function 
[37:32] | Repeat This field is set to 0 on the first memory error and is incremented on any memory error that exactly matches the 
error count | RAMID and Bank/Way information in this register while the sticky Valid bit is set. 
The reset value is 0. 
[31] Valid Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it remains set until 
the register is written. 
The reset value is 0. 
[30:25] | - Reserved, RESO. | 
[24] RAMID RAM Identifier. Indicates the RAM in which the first memory error occurred. The possible values are: 
0x0 L2 tag RAM. 
0x1 L2 data RAM. 
[23:22] | - Reserved, RESO. | 
[21:18] | Way Indicates the RAM where the first memory error occurred. 
L2 tag Ox@ Way 0 L2 data RAM @x@ Bank 0 
RAM 0x1 Way 1 0x1 Bank 1 
OxE Way 14 0x7 Bank 7 
OxF Way 15 0x8-0xF Unused 
[17:16] | - Reserved, RESO. 
[15:3] | Index Indicates the index address of the first memory error. 
[2:0] |- Reserved, RESO. 
Note 
¢ If two or more memory errors in the same RAM occur in the same cycle, only one error is reported. 
¢ Iftwo or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is incremented only by one. 
e Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is incremented only by one. 
To access the LIMERRSR_ELI: 
MRS <Xt>, S3_1_C15_C2_3 ; Read L2MERRSR_EL1 into Xt 
MSR S31 C15 C23, <Xt> ; Write Xt into L2MERRSR_EL1 
4.3.86 Configuration Base Address Register, EL1 
The CBAR_ELI characteristics are: 
Purpose Holds the physical base address of the memory-mapped GIC CPU interface 
registers. 
ARM 100048 _0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-186 
reserved. 


Non-Confidential 


Usage constraints This register is accessible as follows: 
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ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |RO |RO [RO [RO RO 











Configurations There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes CBAR ELI is a 64-bit register. 


The following figure shows the CBAR_ELI bit assignments. 


40 39 


1817 





63 {C {{ 
97 37 
RESO PERIPHBASE[39:18] RESO 


The following table shows the CBAR_EL]1 bit assignments. 


0 


Figure 4-74 CBAR_EL1 bit assignments 


Table 4-130 CBAR_EL1 bit assignments 





Bits Name Function 





[63:40] | - Reserved, RESO. 





[39:18] | PERIPHBASE[39:18] | The input PERIPHBASE[39:18] determines the reset value. 














[17:0] |- Reserved, RESO. 








To access the CBAR_ELI: 


MRS <Xt>, S3_1_C15_C3_@ ; Read CBAR_EL1 into Xt 


4.3.87 DC CIALL Clean Invalidate All 
The DC CIALL characteristics are: 


Purpose Cleans and invalidates all data caches or unified caches. 


Usage constraints This operation can be performed at the following exception levels: 




















ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |wo |wo | wo | wo wo 











Configurations DC CIALL performs the same function as AArch32 operation DCCIALL. 
Attributes DC CIALL is a 32-bit system operation. 


The following figure shows the DC CIALL input value bit assignments. 


31 


4321 0 


Figure 4-75 DC CIALL input value bit assignments 


The DC CIALL input value bit assignments are:. 
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Table 4-131 DC CIALL bit assignments 











Bits Name Function 
[31:4] - Reserved, RESO. 
[3:1] Level Cache level to operate on, minus 1. For 


cache, or 1 for operations on L2 cache. 


example, this field is 0 for operations on L1 








[0] 








Reserved, RESO. 








To perform the DC CIALL operation: 


MSR S11 C15 C14 @, <Xt> 


The operation is encoded as follows: 


Table 4-132 DC CIALL access encoding 
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op0 | op1 | CRn | CRm | op2 
1 001 | 1111 | 1110 | 000 
4-188 


4 System Control 
4.4 AArch32 register summary 


4.4 AArch32 register summary 


In AArch32 state you access the system registers through a conceptual coprocessor, identified as CP15, 
the System Control Coprocessor. 


Within CP15, there is a top-level grouping of system registers by a primary coprocessor register number, 
c0-c15. See the ARM” Architecture Reference Manual ARMV8, for ARMV8-A architecture profile for 
more information about using the conceptual System Control Coprocessor in a VMSA context. 


The system register space includes system registers and system operations. The description of the system 
register space describes the permitted access, RO, WO, or RW, to each register or operation. 


The following sections describe the CP15 system control registers grouped by CRn order, and are 
accessed by the MCR and MRC instructions. 


e 4.4.1 c0 registers on page 4-190. 

e 4.4.2 cl registers on page 4-192. 

e 4.4.3 c2 registers on page 4-192. 

e 4.4.4 c3 registers on page 4-193. 

e 4.4.5 c4 registers on page 4-193. 

e 4.4.6 c5 registers on page 4-193. 

e 4.4.7 c6 registers on page 4-193. 

e 4.4.8 c7 registers on page 4-194. 

e 4.4.9 c7 System operations on page 4-194. 
e 4.4.10 c8 System operations on page 4-195. 
e 4.4.11 c9 registers on page 4-196. 

e 4.4.12 c10 registers on page 4-197. 

e 4.4.13 cll registers on page 4-198. 

e 4.4.14 cl2 registers on page 4-198. 

e 4.4.15 c13 registers on page 4-200. 

e 4.4.16 cl4 registers on page 4-200. 

e 4.4.17 c15 registers on page 4-202. 


The following subsection describes the 64-bit registers and provides cross-references to individual 
register descriptions: 


e 4.4.18 64-bit registers on page 4-202. 


In addition to listing the CP15 system registers by CRn ordering, the following subsections describe the 
CP15 system registers by functional group: 

© 4.4.19 AArch32 Identification registers on page 4-203. 

e 4.4.20 AArch32 Virtual memory control registers on page 4-204. 
e 4.4.21 AArch32 Fault handling registers on page 4-205. 

e 4.4.22 AArch32 Other System registers on page 4-205. 

© 4.4.23 AArch32 Address translation registers on page 4-206. 

© 4.4.24 AArch32 Thread ID registers on page 4-206. 

e 4.4.25 AArch32 Performance monitor registers on page 4-206. 

e 4.4.26 AArch32 Secure registers on page 4-207. 

e 4.4.27 AArch32 Virtualization registers on page 4-209. 

© 4.4.28 AArch32 GIC system registers on page 4-210. 

e 4.4.29 AArch64 Generic Timer registers on page 4-211. 

© 4.4.30 AArch32 Implementation defined registers on page 4-212. 


The following table describes the column headings in the CP15 register summary tables used throughout 
this section. 
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Table 4-133 System register field values 





Heading |Description 

















CRn System control primary register number. 

Opl Arguments to the register access instruction. 

CRm 

Op2 

Name The name of the register or operation. Some assemblers support aliases that you can use to access the registers and 


operations by name. 





Reset Reset value of register. 





Description | Cross-reference to the register description. 














4.4.1 c0 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c0. 
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Table 4-134 c0 register summary 

















































































































CRn | Op1 | CRm | Op2 Name Reset Description 
c0 0 c0 0 MIDR 0x410FD091 4.5.1 Main ID Register on page 4-214 
1 CTR 0x84448004 4.5.25 Cache Type Register on page 4-243 
2 TCMTR 0x00000000 4.5.4 TCM Type Register on page 4-218 
3 TLBTR 0x00000000 4.5.5 TLB Type Register on page 4-218 
4,7 MIDR 0x410FD091 Aliases of Main ID Register, 4.5.71 Main ID Register 
on page 4-214 
5 MPIDR -38 4.5.2 Multiprocessor Affinity Register on page 4-215 
6 REVIDR 0x00000000 4.5.3 Revision ID Register on page 4-217 
cl 0 ID_PFRO 0x00000131 4.5.6 Processor Feature Register 0 on page 4-218 
1 ID_PFRI 0x100110112" 4.5.7 Processor Feature Register 1 on page 4-219 
2 ID_DFRO 0x03010066 4.5.8 Debug Feature Register 0 on page 4-220 
3 ID_AFRO 0x00000000 4.5.9 Auxiliary Feature Register 0 on page 4-221 
4 ID_MMFRO | 0x10201105 4.5.10 Memory Model Feature Register 0 on page 4-221 
5 ID_MMFR] | 0x40000000 4.5.11 Memory Model Feature Register 1 on page 4-223 
6 ID_MMEFR2 | 0x01260000 4.5.12 Memory Model Feature Register 2 on page 4-224 
T ID MMFR3 | 0x02102211 4.5.13 Memory Model Feature Register 3 on page 4-226 
c2 0 ID_ISARO | 0x02101110 4.5.14 Instruction Set Attribute Register 0 on page 4-228 
1 ID_ISAR1 | @x13112111 4.5.15 Instruction Set Attribute Register 1 on page 4-229 
2 ID_ISAR2 |0x21232042 4.5.16 Instruction Set Attribute Register 2 on page 4-231 
3 ID_ISAR3 | @x01112131 4.5.17 Instruction Set Attribute Register 3 on page 4-233 
0 c2 4 ID_ISAR4 |0x00011142 4.5.18 Instruction Set Attribute Register 4 on page 4-234 
5 ID_ISARS | @x00011121 or 4.5.19 Instruction Set Attribute Register 5 on page 4-236 
0x00010001™ 
6 ID_MMFR4 | 0x00000000 4.5.20 Memory Model Feature Register 4 on page 4-238 
1 c0 0 CCSIDR UNK 4.5.21 Cache Size ID Register on page 4-238 
1 CLIDR 0x0A200023 4.5.22 Cache Level ID Register on page 4-240 
7 AIDR 0x00000000 4.5.23 Auxiliary ID Register on page 4-242 
2 c0 0 CSSELR UNK 4.5.24 Cache Size Selection Register on page 4-242 
4 c0 0 VPIDR 0x410FD091 4.5.26 Virtualization Processor ID Register 
on page 4-244 
5 VMPIDR | -3 4.5.27 Virtualization 
Multiprocessor ID Register 
on page 4-245 








a8 The reset value depends on the primary inputs, CLUSTERIDAFF1 and CLUSTERIDAFF?, and the number of cores that the device implements. 
ah Bits [31:28] are @x1 if the GIC CPU interface is enabled, and @x@ otherwise. 
al The value is @x@@011121 if the Cryptographic Extension is implemented and enabled. The value is @x®@010001 if the Cryptographic Extension is not 


implemented and enabled. 


aj The reset value is the value of the Multiprocessor Affinity Register. 
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4.4.2 c1 registers 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is cl. 
Table 4-135 c1 register summary 
CRn | Op1 | CRm | Op2 | Name Reset Description 
cl 0 c0 0 SCTLR | @x@eC5e838"* 4.5.28 System Control Register on page 4-246 
1 ACTLR_ |@0x00000000 4.5.29 Auxiliary Control Register on page 4-249 
2 CPACR |@0x00000000 4.5.30 Architectural Feature Access Control Register 
on page 4-250 
cl 0 SCR 0x00000000 4.5.31 Secure Configuration Register on page 4-252 
1 SDER 0x00000000 4.5.32 Secure Debug Enable Register on page 4-254 
2 NSACR | 0xeeeeeeee"! 4.5.33 Non-Secure Access Control Register on page 4-255 
If EL3 is AArch64 then 
the NSACR reads as 
0x80000CEO. 
c3 1 SDCR 0x00000000 4.5.34 Secure Debug Configuration Register on page 4-256 
4 c0 0 HSCTLR | UNK 4.5.36 Hyp System Control Register on page 4-259 
1 HACTLR | 0x00000000 4.5.35 Hyp Auxiliary Control Register on page 4-258 
cl 0 HCR 0x00000002 4.5.37 Hyp Configuration Register on page 4-262 
1 HDCR 0x00000006 4.5.39 Hyp Debug Control Register on page 4-267 
2 HCPTR |@0x000033FF 4.5.40 Hyp Architectural Feature Trap Register on page 4-270 
3 HSTR 0x00000000 4.5.47 Hyp System Trap Register on page 4-284 
4 HCR2 0x00000000 4.5.38 Hyp Configuration Register 2 on page 4-266 
7 HACR UNK 4.5.40 Hyp Architectural Feature Trap Register on page 4-270 
4.4.3 c2 registers 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c2. 
Table 4-136 c2 register summary 
CRn | Op1 | CRm | Op2 | Name | Reset Description 
c2 0 c0 0 TTBRO | UNK 4.5.41 Translation Table Base Register 0 on page 4-272 
1 TTBRI | UNK 4.5.42 Translation Table Base Register 1 on page 4-275 
2 TTBCR | 9x@0000000™ | 4.5.43 Translation Table Base Control Register on page 4-277 
4 c0 2 HTCR | UNK 4.5.44 Hyp Translation Control Register on page 4-280 
cl 2 VTCR | UNK 4.5.45 Virtualization Translation Control Register on page 4-282 
ak 


al 
am 


The reset value depends on inputs, CFGTE, CFGEND, and VINITHI. This reset value assumes these signals are set to LOW. 
If EL3 is AArch64 then the NSACR reads as OXOOOOACOO. 
The reset value is 02x0@000000 for the Secure copy of the register. The reset value for the EAE bit of the Non-secure copy of the register is @x@. 
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4.4.4 c3 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c3. 


Table 4-137 c3 register summary 





CRn | Opi | CRm | Op2 | Name | Reset | Description 





c3 0 c0 0 DACR | UNK | 4.5.46 Domain Access Control Register on page 4-283 























4.4.5 c4 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c4. 


Table 4-138 c3 register summary 





CRn | Op1 | CRm | Op2 | Name Reset Description 





c4 0 c6 0 ICC_PMR | 0x00000000 | Priority Mask Register 





























4.4.6 c5 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c5. 


Table 4-139 c5 register summary 











CRn | Op1 | CRm | Op2 | Name Reset Description 
c5 0 c0 0 DFSR UNK 4.5.49 Data Fault Status Register on page 4-287 
1 IFSR UNK 4.5.50 Instruction Fault Status Register on page 4-291 





cl 0 ADFSR_ | 0x@0000000 | 4.5.51 Auxiliary Data Fault Status Register on page 4-294 





1 AIFSR Qx00000808 | 4.5.52 Auxiliary Instruction Fault Status Register on page 4-294 





c5 4 cl 0 HADEFSR | 0x000000@8 | 4.5.53 Hyp Auxiliary Data Fault Status Syndrome Register on page 4-294 





1 HAIFSR | 0x@0000008 | 4.5.54 Hyp Auxiliary Instruction Fault Status Syndrome Register 
on page 4-294 





c2 0 HSR UNK 4.5.55 Hyp Syndrome Register on page 4-294 





























4.4.7 c6 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c6. 


Table 4-140 c6 register summary 



























































CRn | Op1 | CRm | Op2 | Name | Reset | Description 

c6 0 c0 0 DFAR |UNK | 4.5.56 Data Fault Address Register on page 4-295 
2 IFAR |UNK_ | 4.5.57 Instruction Fault Address Register on page 4-296 

4 c0 0 HDFAR |UNK | 4.5.58 Hyp Data Fault Address Register on page 4-297 
2 HIFAR |UNK_ | 4.5.59 Hyp Instruction Fault Address Register on page 4-298 
4 HPFAR | UNK_ | 4.5.60 Hyp IPA Fault Address Register on page 4-299 
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4.4.8 c7 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c7. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 





























information. 
Table 4-141 c7 register summary 
CRn | Opi | CRm | Op2 | Name | Reset | Description 
c7 0 c4 0 PAR |UNK | 4.5.61 Physical Address Register on page 4-299 
4.4.9 c7 System operations 


The following table shows the System operations when CRn is c7 and the processor is in AArch32 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 
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Table 4-142 c7 System operation summary 





op1 | CRm | op2 | Name Description 





0 cl 0 ICIALLUIS | Invalidate all instruction caches Inner Shareable to PoU*" 





6 BPIALLIS Invalidate all entries from branch predictors Inner Shareable 





c5 0 ICIALLU Invalidate all Instruction Caches to PoU 





1 ICIMVAU Invalidate Instruction Caches by VA to PoU 











4 CP15ISB Instruction Synchronization Barrier operation, this operation is deprecated in ARMv8-A 
6 BPIALL Invalidate all entries from branch predictors 
7 BPIMVA Invalidate VA from branch predictors 





c6 1 DCIMVAC Invalidate data cache line by VA to PoC*® 





2 DCISW Invalidate data cache line by set/way 





c8 0 ATS1CPR Stage 1 current state PL1 read 





1 ATS1CPW Stage 1 current state PL1 write 





2 ATS1CUR Stage 1 current state unprivileged read 





3 ATS1CUW Stage 1 current state unprivileged write 





4 ATS12NSOPR | Stages 1 and 2 Non-secure only PL1 read 





5 ATS12NSOPW | Stages 1 and 2 Non-secure only PL1 write 





6 ATS12NSOUR | Stages 1 and 2 Non-secure only unprivileged read 





7 ATS12NSOUW | Stages 1 and 2 Non-secure only unprivileged write 





cl0 |1 DCCMVAC Clean data cache line by VA to PoC 





2 DCCSW Clean data cache line by set/way 





4 CP15DSB Data Synchronization Barrier operation, this operation is deprecated in ARMv8-A 





5 CP15DMB Data Memory Barrier operation, this operation is deprecated in ARMv8-A 





cll 1 DCCMVAU Clean data cache line by VA to PoU 





cl4 |1 DCCIMVAC Clean and invalidate data cache line by VA to PoC 





























2 DCCISW Clean and invalidate data cache line by set/way 
4 c8 0 ATS1HR Stage 1 Hyp mode read 
1 ATS1HW Stage 1 Hyp mode write 





4.4.10 c8 System operations 
The following table shows the System operations when CRn is c8 and the processor is in AArch32 state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these operations. 





an PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside of the processor, in which case PoU is 
dependent on the external memory system. 
a0 PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the external memory system. 
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Table 4-143 c8 System operations summary 




















































































































op1 | CRm | op2 | Name Description 
0 c3 0 TLBIALLIS Invalidate entire TLB Inner Shareable 
1 TLBIMVAIS Invalidate unified TLB entry by VA and ASID Inner Shareable 
2 TLBIASIDIS Invalidate unified TLB by ASID match Inner Shareable 
3 TLBIMVAAIS Invalidate unified TLB entry by VA all ASID Inner Shareable 
5 TLBIMVALIS Invalidate unified TLB entry by VA Inner Shareable, Last level 
7 TLBIMVAALIS Invalidate unified TLB by VA all ASID Inner Shareable, Last level 
c5 0 ITLBIALL Invalidate instruction TLB 
1 ITLBIMVA Invalidate instruction TLB entry by VA and ASID 
2 ITLBIASID Invalidate instruction TLB by ASID match 
c6 0 DTLBIALL Invalidate data TLB 
1 DTLBIMVA Invalidate data TLB entry by VA and ASID 
2 DTLBIASID Invalidate data TLB by ASID match 
c7 0 TLBIALL Invalidate unified TLB 
1 TLBIMVA Invalidate unified TLB by VA and ASID 
2 TLBIASID Invalidate unified TLB by ASID match 
3 TLBIMVAA Invalidate unified TLB entries by VA all ASID 
5 TLBIMVAL Invalidate last level of stage 1 TLB entry by VA 
7 TLBIMVAAL Invalidate last level of stage 1 TLB entry by VA all ASID 
4 c0 1 TLBIIPAS2I1S TLB Invalidate entry by Intermediate Physical Address, Stage 2, Inner Shareable 
5 TLBIIPAS2LIS | TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level, Inner Shareable 
c3 0 TLBIALLHIS Invalidate entire Hyp unified TLB Inner Shareable 
1 TLBIMVAHIS Invalidate Hyp unified TLB entry by VA Inner Shareable 
4 TLBIALLNSNHTIS | Invalidate entire Non-secure non-Hyp unified TLB Inner Shareable 
5 TLBIMVALHIS Invalidate Unified Hyp TLB entry by VA Inner Shareable, Last level 
c4 1 TLBIIPAS2 TLB Invalidate entry by Intermediate Physical Address, Stage 2 
5 TLBIIPAS2L TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level 
c7 0 TLBIALLH Invalidate entire Hyp unified TLB 
1 TLBIMVAH Invalidate Hyp unified TLB entry by VA 
4 TLBIALLNSNH Invalidate entire Non-secure non-Hyp unified TLB 
5 TLBIMVALH Invalidate Unified Hyp TLB entry by VA, Last level 
4.4.11 c9 registers 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c9. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
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Table 4-144 c9 register summary 












































































































































CRn | Op1 | CRm | Op2 | Name Reset Description 
c9 0 cl2 JO PMCR 0x41043009 | Performance Monitor Control Register 
1 PMNCNTENSET | UNK Performance Monitors Count Enable Set Register 
2 PMNCNTENCLR | UNK Performance Monitors Count Enable Clear Register 
3 PMOVSR UNK Performance Monitors Overflow Flag Status Clear Register 
4 PMSWINC UNK Performance Monitors Software Increment Register 
5 PMSELR UNK Performance Monitors Event Counter Selection Register 
6 PMCEIDO @x7BFF7F3F | Common Event Identification Register 0 
7 PMCEID1 0x00000000 | Common Event Identification Register 1 
c13 JO PMCCNTR UNK Performance Monitors Cycle Counter 
1 PMXEVTYPER | UNK Performance Monitors Selected Event Type and Filter Register 
2 PMXEVCNTR UNK Performance Monitors Selected Event Counter Register 
cl4 J0 PMUSERENR 0x00000009 | Performance Monitors User Enable Register 
1 PMINTENSET UNK Performance Monitors Interrupt Enable Set Register 
2 PMINTENCLR- | UNK Performance Monitors Interrupt Enable Clear Register 
3 PMOVSSET UNK Performance Monitor Overflow Flag Status Set Register 
1 c0 2 L2CTLR -aP 4.5.62 L2 Control Register on page 4-299 
3 L2ECTLR Qx000008@8 | 4.5.63 L2 Extended Control Register on page 4-302 
4.4.12 c10 registers 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c10. 
Table 4-145 c10 register summary 
CRn | Op1 | CRm | Op2 | Name Reset Description 
cl0 |0 c2 0 PRRR UNK 4.5.64 Primary Region Remap Register on page 4-304 
0 MAIRO UNK 4.5.65 Memory Attribute Indirection Registers 0 and 1 on page 4-307 
1 NMRR UNK 4.5.66 Normal Memory Remap Register on page 4-309 
1 MAIRI UNK 4.5.65 Memory Attribute Indirection Registers 0 and 1 on page 4-307 
c3 0 AMAIRO |0x00000000 | 4.5.67 Auxiliary Memory Attribute Indirection Register 0 on page 4-310 
1 AMAIR1 _ | 0x000000@O | 4.5.68 Auxiliary Memory Attribute Indirection Register 1 on page 4-310 
4 c2 0 HMAIRO | UNK Hyp Memory Attribute Indirection Register 0°4 
1 HMAIRI | UNK Hyp Memory Attribute Indirection Register 1°4 
c3 0 HAMAIRO | 0x000000@8@ | 4.5.69 Hyp Auxiliary Memory Attribute Indirection Register 0 on page 4-310 
1 HAMAIRI | 0x00000000 | 4.5.70 Hyp Auxiliary Memory Attribute Indirection Register 1 on page 4-310 





























ap 


The reset value depends on the processor configuration. 
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4.4.13 c11 registers 
There are no system registers to access when the processor is in AArch32 state and the value of CRn is 
cll. 
4.4.14 c12 registers 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c12. 
Table 4-146 c12 register summary 
CRn | Op1 | CRm | Op2 | Name Reset Description 
cl2 |0 c0 0 VBAR UNK* 4.5.71 Vector Base Address Register on page 4-310. 
1 MVBAR UNK Monitor Vector Base Address Register. See the ARM® Architecture 
Reference Manual ARMV8, for ARMv8-A architecture profile for more 
information. 
2 RMR a 4.5.72 Reset Management Register on page 4-311. 
cl 0 ISR UNK 4.5.73 Interrupt Status Register on page 4-312. 
c8 0 ICC_IARO - Interrupt Acknowledge Register 0 
1 ICC_EOIRO - End Of Interrupt Register 0 
2 ICC_HPPIRO - Highest Priority Pending Interrupt Register 0 
3 ICC_BPRO 0x00000002 | Binary Point Register 0 
4 ICC_APORO 0x0000O0OO | Active Priorities 0 Register 0 





















































aq 
ar 
as 


See the ARM” Architecture Reference Manual ARMvé8, for ARMv8-A architecture profile for more information. 
This is the reset value in Non-secure state. In Secure state, the reset value is 0x00000000. 
The Cold reset value depends on the AA64nAA32 signal. 
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Table 4-146 c12 register summary (continued) 





























































































































CRn | Op1 | CRm | Op2 | Name Reset Description 
cl2 |0 c9 0 ICC_API1RO @x80008008 | Active Priorities 1 Register 0 
cll 1 ICC_DIR - Deactivate Interrupt Register 
3 ICC_RPR - Running Priority Register 
cl2 JO ICC_IARI - Interrupt Acknowledge Register 1 
1 ICC_EOIR1 - End Of Interrupt Register 1 
2 ICC_HPPIR1 - Highest Priority Pending Interrupt Register 1 
3 ICC_BPRI 0x00000003* | Binary Point Register 1 
4 ICC_CTLR 0x000004090 | Interrupt Control Register 
5 ICC_SRE Qx80080808 | System Register Enable Register 
6 ICC_IGRPENO | 0x000000@0 | Interrupt Group Enable Register 0 
7 ICC_IGRPEN1 | 0x0000088@ | Interrupt Group Enable Register 1 
4 c0 0 HVBAR UNK 4.5.74 Hyp Vector Base Address Register on page 4-313. 
c8 0 ICH_APORO @x80088008 | Interrupt Controller Hyp Active Priorities Register (0,0) 
c9 0 ICH_AP1RO 0x0000000O | Interrupt Controller Hyp Active Priorities Register (1,0) 
4 ICH_VSEIR @x80008008 | Interrupt Controller Virtual System Error Interrupt Register 
5 ICC_HSRE 0xX0000000O | System Register Enable Register for EL2 
cll JO ICH_HCR @x80088008 | Interrupt Controller Hyp Control Register 
1 ICH_VTR @x90008003 | Interrupt Controller VGIC Type Register 
2 ICH_MISR @x80008008 | Interrupt Controller Maintenance Interrupt State Register 
3 ICH_EISR @x80088008 | Interrupt Controller End of Interrupt Status Register 
7 ICH_VMCR 0X004CO0OO | Interrupt Controller Virtual Machine Control Register 
5 ICH_ELRSR @x80@8800F | Interrupt Controller Empty List Register Status Register 
cl2 JO ICH_LRO Qx80080888 | Interrupt Controller List Register 0 
1 ICH_LR1 @x80088008 | Interrupt Controller List Register 1 
2 ICH_LR2 @x80008008 | Interrupt Controller List Register 2 
3 ICH_LR3 Qx80088808 | Interrupt Controller List Register 3 
cl4 JO ICH_LRCO @x80088008 | Interrupt Controller List Register 0 
1 ICH_LRC1 Qx80080008 | Interrupt Controller List Register 1 
2 ICH_LRC2 @x80008008 | Interrupt Controller List Register 2 
3 ICH_LRC3 @x80088008 | Interrupt Controller List Register 3 
cl2 |6 cl2 |4 ICC_MCTLR 0x00000400 | Interrupt Control Register for EL3 
5 ICC_MSRE 0x0000000O | System Register Enable Register for EL3 
7 ICC_MGRPEN|1 | 0x00000000 | Interrupt Controller Monitor Interrupt Group 1 Enable register 











at 


This is the reset value in Non-secure state. In Secure state, the reset value is 0x00000002. 
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4 System Control 
4.4 AArch32 register summary 


The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c13. 


Table 4-147 c13 register summary 






































CRn | Op1 | CRm | Op2 | Name Reset Description 
c13 |0 c0 0 FCSEIDR 0x0000000O | 4.5.75 FCSE Process ID Register on page 4-314 
1 CONTEXTIDR | UNK Context ID Register*" 
2 TPIDRURW UNK User Read/Write Thread ID Register™" 
3 TPIDRURO UNK User Read-Only Thread ID Register*" 
4 TPIDRPRW UNK EL1 only Thread ID Register?" 
4 c0 2 HTPIDR UNK Hyp Software Thread ID Register*" 























4.4.16 c14 registers 


The following table shows the CP15 system registers when the processor is in AArch32 state and the 
value of CRn is c14. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 





au See the ARM” Architecture Reference Manual ARMV8, for ARMv8-A architecture profile. 
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Table 4-148 c14 register summary 































































































Op1 | CRm | Op2 | Name Reset 
0 c0 0 CNTFRQ UNK Timer Counter Frequency Register 
cl 0 CNTKCTL Av Timer Control Register 
c2 0 CNTP_TVAL |UNK Physical Timer TimerValue Register 
1 CNTP_CTL “aw Physical Timer Control Register 
c3 0 CNTV_TVAL | UNK Virtual Timer TimerValue Register 
1 CNTV_CTL aw Counter-timer Virtual Timer Control Register 
c8 0 PMEVCNTRO | UNK Performance Monitors Event Count Registers 
1 PMEVCNTRI | UNK 
2 PMEVCNTR2 | UNK 
3 PMEVCNTR3 | UNK 
4 PMEVCNTR4 | UNK 
5 PMEVCNTRS | UNK 
cl2 |O PMEVTYPERO | UNK Performance Monitors Event Type Registers 
1 PMEVTYPERI | UNK 
2 PMEVTYPER2 | UNK 
3 PMEVTYPER3 | UNK 
4 PMEVTYPER4 | UNK 
5 PMEVTYPERS | UNK 
cl5 |7 PMCCFILTR |@0x00000000 | Performance Monitors Cycle Count Filter Register. 
4 cl 0 CNTHCTL a Timer Control Register (EL2) 
c2 0 CNTHP_TVAL | UNK Physical Timer TimerValue (EL2) 
1 CNTHP_CTL |-°” Physical Timer Control Register (EL2) 
































aV The reset value for bits[9:8, 2:0] is @b00000. 


aw The reset value for bit[0] is 0. 


aX The reset value for bit[2] is 0 and for bits[1:0] is @b11. 
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4.4.17 c15 registers 
The following table shows the 32-bit wide system registers you can access when the processor is in 
AArch32 state and the value of CRn is c15. 
Table 4-149 c15 register summary 
Op1 | CRm | Op2 | Name Reset Description 
1 c2 1 ECTLR 0x000005890 | 4.5.76 Extended Control Register on page 4-314 
3 L2MERRSR | 0x00000000 | 4.5.77 L2 Memory Error Syndrome Register on page 4-316 
c3 0 CBAR AY 4.5.78 Configuration Base Address Register on page 4-317 
cl4 |0 DCCIALL |UNK 4.5.79 DCCIALL Clean Invalidate All on page 4-318 
3 c0 0 CDBGDRO |UNK Cache Debug Data Register 0, see 6.7 Direct access to internal memory 
on page 6-337 
1 CDBGDR1 |UNK Cache Debug Data Register 1, see 6.7 Direct access to internal memory 
on page 6-337 
2 CDBGDR2 | UNK Cache Debug Data Register 2, see 6.7 Direct access to internal memory 
on page 6-337 
3 CDBGDR3 | UNK Cache Debug Data Register 3, see 6.7 Direct access to internal memory 
on page 6-337 
c2 0 CDBGDCT | UNK Cache Debug Data Cache Tag Read Operation Register, see 6.7 Direct access to 
internal memory on page 6-337 
1 CDBGICT |UNK Cache Debug Instruction Cache Tag Read Operation Register, see 6.7 Direct access 
to internal memory on page 6-337 
c4 0 CDBGDCD | UNK Cache Debug Cache Debug Data Cache Data Read Operation Register, see 
6.7 Direct access to internal memory on page 6-337 
1 CDBGICD |UNK Cache Debug Instruction Cache Data Read Operation Register, see 6.7 Direct 
access to internal memory on page 6-337 
2 CDBGTD |UNK Cache Debug TLB Data Read Operation Register, see 6.7 Direct access to internal 
memory on page 6-337 
4.4.18 64-bit registers 


The following table shows the 64-bit wide CP15 system registers, accessed by the MCRR and MRRC 




















instructions. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
Table 4-150 64-bit register summary 
Op1 | CRm | Name Reset Description 
0 c2 TTBRO UNK Translation Table Base Register 0 
1 c2 TTBRI UNK Translation Table Base Register 1 
4 c2 HTTBR UNK Hyp Translation Table Base Register 
6 c2 VTTBR UNK Virtualization Translation Table Base Register 
0 c7 PAR UNK 4.5.61 Physical Address Register on page 4-299 



































ay 


The reset value depends on the processor configuration. 
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Table 4-150 64-bit register summary (continued) 



























































Op1 | CRm | Name Reset Description 

3 c13 | PMCCNTR UNK Cycle Count Register 

0 c14 | CNTPCT UNK Physical Timer Count Register 

1 cl4 | CNTVCT UNK Virtual Timer Count Register 

2 cl4 |CNTP_CVAL |UNK Physical Timer CompareValue Register 

3 cl4 |CNTV_CVAL |UNK Virtual Timer CompareValue Register 

4 cl4 | CNTVOFF UNK Virtual Timer Offset Register 

6 cl4 | CNTHP_CVAL | UNK Physical Timer CompareValue Register 

1 c15 |ECTLR 0x0000000000000580 | 4.5.76 Extended Control Register on page 4-314 

3 cl5  |L2MERRSR Qx80000000800800880 | 4.5.77 L2 Memory Error Syndrome Register on page 4-316 











4.4.19 AArch32 Identification registers 


The following table shows the identification registers. 
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Table 4-151 Identification registers 




























































































































































































Name CRn | Op1 | CRm | Op2 | Reset Description 
MIDR c0 0 c0 0 0x410FD091 4.5.1 Main ID Register on page 4-214 
CTR 1 0x84448004 4.5.25 Cache Type Register on page 4-243 
TCMTR 2 0x00000000 4.5.4 TCM Type Register on page 4-218 
TLBTR 3 0x00000000 4.5.5 TLB Type Register on page 4-218 
MPIDR > late 4.5.2 Multiprocessor Affinity Register on page 4-215 
REVIDR 6 0x00000000 4.5.3 Revision ID Register on page 4-217 
ID_PFRO cl 0 0x00000131 4.5.6 Processor Feature Register 0 on page 4-218 
ID_PFRI 1 ex10e11011°* 4.5.7 Processor Feature Register 1 on page 4-219 
ID_DFRO 2 0x03010066 4.5.8 Debug Feature Register 0 on page 4-220 
ID_AFRO 3 0x80080000 4.5.9 Auxiliary Feature Register 0 on page 4-221 
ID_MMFRO 4 @x10201105 4.5.10 Memory Model Feature Register 0 on page 4-221 
ID_MMFR1 5 0x40000000 4.5.11 Memory Model Feature Register 1 on page 4-223 
ID_MMFR2 6 0x01260000 4.5.12 Memory Model Feature Register 2 on page 4-224 
ID_MMFR3 7 @x@2102211 4.5.13 Memory Model Feature Register 3 on page 4-226 
ID_ISARO c2 0 @x02101110 4.5.14 Instruction Set Attribute Register 0 on page 4-228 
ID_ISAR1 1 @x13112111 4.5.15 Instruction Set Attribute Register 1 on page 4-229 
ID_ISAR2 2 @x21232042 4.5.16 Instruction Set Attribute Register 2 on page 4-231 
ID_ISAR3 3 @x01112131 4.5.17 Instruction Set Attribute Register 3 on page 4-233 
ID_ISAR4 4 @x00011142 4.5.18 Instruction Set Attribute Register 4 on page 4-234 
ID_ISARS 5 0x00011121 or @xee010001" | 4.5.19 Instruction Set Attribute Register 5 on page 4-236 
CCSIDR 1 c0 0 - 4.5.21 Cache Size ID Register on page 4-238 
CLIDR 1 0x0@A200023 4.5.22 Cache Level ID Register on page 4-240 
AIDR 7 0x00000000 4.5.23 Auxiliary ID Register on page 4-242 
CSSELR 2 c0 0 UNK 4.5.24 Cache Size Selection Register on page 4-242 
4.4.20 AArch32 Virtual memory control registers 
The following table shows the virtual memory control registers. 
Table 4-152 Virtual memory control registers 
Name CRn | Op1 | CRm | Op2 | Reset Width | Description 
SCTLR cl 0 c0 0 @x@0C50838"° | 32-bit | 4.5.28 System Control Register on page 4-246 
TTBRO c2 0 c0 0 UNK 32-bit | Translation Table Base Register 0, see the ARM® Architecture 
p 0 2 i 64-bit Reference Manual ARMVv8, for ARMv8-A architecture profile 
































az 


ba = Bits [31:28] 
bb The value is 
be 


The reset val 


implemented and enabled. 


The reset val 





ue depends on the primary inputs, CLUSTERIDAFF1 and CLUSTERIDAFF2, and the number of cores that the device implements. 
are @x1 if the GIC CPU interface is enabled, and @x@ otherwise. 
@x@0011121 if the Cryptographic Extension is implemented and enabled. The value is @x®0010001 if the Cryptographic Extension is not 


ue depends on inputs, CFGTE, CFGEND, and VINITHI. This reset value assumes these signals are set to LOW. 
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Table 4-152 Virtual memory control registers (continued) 






























































































































































Name CRn | Op1 | CRm | Op2 | Reset Width | Description 
TTBR1 - 0 c0 1 UNK 32-bit | Translation Table Base Register 1, see the ARM® Architecture 
_ | Reference Manual ARMVv8, for ARMv8-A architecture profile 
- 1 c2 - 64-bit 
TTBCR - 0 c0 2 OxXOOOOOOOO! | 32-bit | 4.5.43 Translation Table Base Control Register on page 4-277 
DACR c3 0 c0 0 UNK 32-bit | 4.5.46 Domain Access Control Register on page 4-283 
PRRR cl0 |0 c2 0 UNK 32-bit | 4.5.64 Primary Region Remap Register on page 4-304 
MAIRO 0 UNK 32-bit | 4.5.65 Memory Attribute Indirection Registers 0 and 1 
on page 4-307 
NMRR 1 UNK 32-bit | 4.5.66 Normal Memory Remap Register on page 4-309 
MAIRI 1 UNK 32-bit | 4.5.65 Memory Attribute Indirection Registers 0 and 1 
on page 4-307 
AMAIRO c3 0 Qx00088888 | 32-bit | 4.5.67 Auxiliary Memory Attribute Indirection Register 0 
on page 4-310 
AMAIR1 1 @x80088000 | 32-bit | 4.5.68 Auxiliary Memory Attribute Indirection Register 1 
on page 4-310 
CONTEXTIDR |c13 | 0 c0 1 UNK 32-bit | Context ID Register, see the ARM" Architecture Reference 
Manual ARMVv8, for ARMvS8-A architecture profile 
4.4.21 AArch32 Fault handling registers 
The following table shows the Fault handling registers in the AArch32 Execution state. 
Table 4-153 Fault handling registers 
Name /|CRn | Op1|CRm | Op2 | Reset Description 
DFSR_ | c5 0 c0 0 UNK 4.5.49 Data Fault Status Register on page 4-287 
IFSR 1 UNK 4.5.50 Instruction Fault Status Register on page 4-291 
ADFSR cl 0 0x000000@8 | 4.5.51 Auxiliary Data Fault Status Register on page 4-294 
AIFSR 1 0x000088@8 | 4.5.52 Auxiliary Instruction Fault Status Register on page 4-294 
DFAR_ | c6 0 c0 0 UNK Data Fault Address Register, see the ARM” Architecture Reference Manual 
ARMV8, for ARMv8-A architecture profile 
IFAR 2 UNK Instruction Fault Address Register, see the ARM” Architecture Reference Manual 
ARMV8, for ARMv8-A architecture profile 
The Virtualization registers include additional fault handling registers. For more information see 
4.4.27 AArch32 Virtualization registers on page 4-209. 
4.4.22 AArch32 Other System registers 
The following table shows the other system registers. 
bd 


The reset value is 2x@@0000@@ for the Secure copy of the register. The reset value for the EAE bit of the Non-secure copy of the register is @x@. You must program 


the Non-secure copy of the register with the required initial value, as part of the processor boot sequence. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


4-205 


reserved. 


Non-Confidential 


4 System Control 
4.4 AArch32 register summary 


Table 4-154 Other system registers 





Name CRn | Op1 | CRm | Op2 | Reset Description 





ACTLR {cl 0 c0 1 0x800088@8 | 4.5.29 Auxiliary Control Register on page 4-249 





CPACR 2 0x800088@8 | 4.5.30 Architectural Feature Access Control Register on page 4-250 








FCSEIDR | c13 | 0 c0 0 0x00000000 | 4.5.75 FCSE Process ID Register on page 4-314 


























4.4.23 AArch32 Address translation registers 
The following table shows the address translation registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


Table 4-155 Address translation registers. 





Name | CRn | Op1 | CRm | Op2 | Reset | Width | Description 





PAR |c7 0 c4 0 UNK | 32-bit | 4.5.61 Physical Address Register on page 4-299 








- c7 - 64-bit 
































4.4.24 AArch32 Thread ID registers 
The following table shows the thread ID registers. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


















































information. 

Table 4-156 Thread ID registers 
Name CRn | Op1 | CRm | Op2 | Reset | Description 
TPIDRURW |c13 | 0 c0 2 UNK | User Read/Write Thread ID Register 
TPIDRURO 3 UNK | User Read-Only Thread ID Register 
TPIDRPRW 4 UNK | EL1 only Thread ID Register 
HTPIDR 4 c0 2 UNK |Hyp Software Thread ID Register 

4.4.25 AArch32 Performance monitor registers 


The following table shows the performance monitor registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for more 
information. 
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Table 4-157 Performance monitor registers 



































































































































































































































Name CRn | Op1 | CRm | Op2 | Reset Description 
PMCR c9 0 c12 JO 0x41043000 | 11.4.1 Performance Monitors Control Register on page 11-431 
PMCNTENSET 1 UNK Performance Monitors Count Enable Set Register 
PMCNTENCLR 2 UNK Performance Monitors Count Enable Clear Register 
PMOVSR 3 UNK Performance Monitors Overflow Flag Status Register 
PMSWINC 4 UNK Performance Monitors Software Increment Register 
PMSELR 5 UNK Performance Monitors Event Counter Selection Register 
PMCEIDO 6 @x7BFF7F3F | 71.4.2 Performance Monitors Common Event Identification Register 0 
on page 11-433 
PMCEID1 7 @x80008008 | 11.4.3 Performance Monitors Common Event Identification Register 1 
on page 11-436 
PMCCNTR c13 JO UNK Performance Monitors Cycle Count Register 
PMXEVTYPER 1 UNK Performance Monitors Selected Event Type Register 
PMXEVCNTR 2 UNK Performance Monitors Event Count Registers 
PMUSERENR cl4 JO 0x0000000O | Performance Monitors User Enable Register 
PMINTENSET 1 UNK Performance Monitors Interrupt Enable Set Register 
PMINTENCLR 2 UNK Performance Monitors Interrupt Enable Clear Register 
PMOVSSET 3 UNK Performance Monitor Overflow Flag Status Set Register 
PMEVCNTRO |cl4 |0 c8 0 UNK Performance Monitors Event Count Register 0 
PMEVCNTRI 1 UNK Performance Monitors Event Count Register 1 
PMEVCNTR2 2 UNK Performance Monitors Event Count Register 2 
PMEVCNTR3 3 UNK Performance Monitors Event Count Register 3 
PMEVCNTR4 4 UNK Performance Monitors Event Count Register 4 
PMEVCNTRS5 5 UNK Performance Monitors Event Count Register 5 
PMEVTYPERO c12 JO UNK Performance Monitors Event Type Register 0 
PMEVTYPER1 1 UNK Performance Monitors Event Type Register 1 
PMEVTYPER2 2 UNK Performance Monitors Event Type Register 2 
PMEVTYPER3 3 UNK Performance Monitors Event Type Register 3 
PMEVTYPER4 4 UNK Performance Monitors Event Type Register 4 
PMEVTYPERS 5 UNK Performance Monitors Event Type Register 5 
PMCCFILTR c15 |7 @x8008008 | Performance Monitors Cycle Count Filter Register 
4.4.26 AArch32 Secure registers 


The following table shows the Secure registers. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 


information. 
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Table 4-158 Secure registers 





Name |CRn | Op1 | CRm | Op2 | Reset Description 





SCR cl 0 cl 0 @x90e08800 | 4.5.31 Secure Configuration Register on page 4-252 



































SDER 1 UNK Secure Debug Enable Register 

NSACR 2 exeeegeaeee"” | 4.5.33 Non-Secure Access Control Register on page 4-255 
VBAR |cl2 |0 c0 0 UNK”! 4.5.71 Vector Base Address Register on page 4-310 
MVBAR 1 UNK Monitor Vector Base Address Register 

ISR cl 0 UNK Interrupt Status Register 



































be If EL3 is AArch64 then the NSACR reads as @x@0000C8O. 
bf This is the reset value in Non-secure state. In Secure state, the reset value is 0x00000000. 
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4.4.27 AArch32 Virtualization registers 
The following table shows the Virtualization registers. 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 
Table 4-159 Virtualization registers 
Name CRn | Op1 | CRm | Op2 | Reset Width | Description 
VPIDR c0 4 c0 0 0x410FD091 | 32-bit | 4.5.26 Virtualization Processor ID Register on page 4-244 
VMPIDR 5 -bg 32-bit | 4.5.27 Virtualization Multiprocessor ID Register on page 4-245 
HSCTLR {cl 4 c0 0 UNK 32-bit | 4.5.36 Hyp System Control Register on page 4-259 
HACTLR 1 UNK 4.5.35 Hyp Auxiliary Control Register on page 4-258 
HCR cl 0 0x00000002 | 32-bit | Hyp Configuration Register 
HDCR 1 Qx000008@6 | 32-bit | 4.5.39 Hyp Debug Control Register on page 4-267 
HCPTR 2 0x000033FF | 32-bit | 4.5.40 Hyp Architectural Feature Trap Register on page 4-270 
HSTR 3 Qx000008@8 | 32-bit | Hypervisor System Trap Register 
HTCR c2 4 c0 2 UNK 32-bit | 4.5.44 Hyp Translation Control Register on page 4-280 
VTCR cl 2 UNK 32-bit | Virtualization Translation Control Register 
HTTBR - 4 c2 - UNK 64-bit | Hyp Translation Table Base Register 
VTTBR - 6 c2 - UNK 64-bit | Virtualization Translation Table Base Register 
HADFSR | c5 4 cl 0 Ox0000000O | 32-bit | 4.5.53 Hyp Auxiliary Data Fault Status Syndrome Register 
on page 4-294 
HAIFSR 1 0x800008@8 | 32-bit | 4.5.54 Hyp Auxiliary Instruction Fault Status Syndrome Register 
on page 4-294 
HSR c2 0 UNK 32-bit | 4.5.55 Hyp Syndrome Register on page 4-294 
HDFAR c6 4 c0 0 UNK 32-bit | Hyp Data Fault Address Register 
HIFAR UNK 32-bit | Hyp Instruction Fault Address Register 
HPFAR 4 UNK 32-bit | Hyp IPA Fault Address Register 
HMAIRO |cl0 |4 c2 0 UNK 32-bit | Hyp Memory Attribute Indirection Register 0 
HMAIR1 1 UNK 32-bit | Hyp Memory Attribute Indirection Register 1 
HAMAIRO c3 0 OxX0000O0OO | 32-bit | 4.5.69 Hyp Auxiliary Memory Attribute Indirection Register 0 
on page 4-310 
HAMAIR1 1 Qx000088@8 | 32-bit | 4.5.70 Hyp Auxiliary Memory Attribute Indirection Register 1 
on page 4-310 
HVBAR |cl2 |4 c0 0 UNK 32-bit | Hyp Vector Base Address Register 
































bg The reset value is the value of the Multiprocessor Affinity Register. 
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4.4.28 AArch32 GIC system registers 
The following table shows the GIC system registers in AArch32 state. 
Table 4-160 AArch32 GIC system registers 

Name CRn | Op1 | CRm | Op2 | Type | Reset Width | Description 

ICC_SGIIR - 0 c12 |- WO |- 64-bit | SGI Generation Register 1 

ICC_ASGIIR 1 c12 |- WO |- 64-bit | Alternate SGI Generation Register 1 

ICC_SGIOR 2 c12 |- WO |- 64-bit | SGI Generation Register 0 

ICC_PMR c4 0 c6 0 RW |@©x00000000 | 32-bit | Priority Mask Register 

ICC_IARO cl2 |0 c8 0 RO |J- 32-bit | Interrupt Acknowledge Register 0 

ICC_EOIRO 1 WO |- 32-bit | End Of Interrupt Register 0 

ICC_HPPIRO 2 RO |- 32-bit | Highest Priority Pending Interrupt Register 0 

ICC_BPRO 3 RW_ | 0x00@000002 = | 32-bit | Binary Point Register 0 

ICC_APORO 4 RW | 0x@@800080 = | 32-bit | Active Priorities 0 Register 0 

ICC_AP1RO c9 0 RW | 0x@0@800800 |32-bit | Active Priorities 1 Register 0 

ICC_DIR cll 1 WO |- 32-bit | Deactivate Interrupt Register 

ICC_RPR 3 RO |- 32-bit | Running Priority Register 

ICC_IAR1 c12 JO RO |J- 32-bit | Interrupt Acknowledge Register 1 

ICC_EOIR1 1 WO |- 32-bit | End Of Interrupt Register 1 

ICC_HPPIR1 2 RO |J- 32-bit | Highest Priority Pending Interrupt Register 1 

ICC_BPRI 3 RW | 0xeeee0003°" | 32-bit | Binary Point Register 1 

ICC_CTLR 4 RW | 0x00000400 = | 32-bit | Interrupt Control Register 

ICC_SRE 5 RW | 0x00000008 | 32-bit | System Register Enable Register 

ICC_IGRPENO 6 RW | 0x@8@000080 | 32-bit | Interrupt Group Enable Register 0 

ICC_IGRPEN1 7 RW | 0x00000000 = | 32-bit | Interrupt Group Enable Register 1 

ICH_APORO 4 c8 0 RW | 0x08@000080 = | 32-bit | Interrupt Controller Hyp Active Priorities Register 
(0,0) 

ICH_AP1IRO c9 0 RW |@©x00000000 |32-bit | Interrupt Controller Hyp Active Priorities Register 
(1,0) 

ICC_HSRE 5 RW | 0x@8@000880 | 32-bit | System Register Enable Register for EL2 

ICH_HCR cll JO RW | 0x08@800880 = | 32-bit | Interrupt Controller Hyp Control Register 

ICH_VTR 1 RO | 0x90000003 = | 32-bit | Interrupt Controller VGIC Type Register 

ICH_MISR 2 RO | 0x@8@000880 = | 32-bit | Interrupt Controller Maintenance Interrupt State 
Register 






































bh This is the reset value in Non-secure state. In Secure state, the reset value is 0x00000002. 
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Table 4-160 AArch32 GIC system registers (continued) 




















































































































Name CRn | Op1 | CRm | Op2 | Type | Reset Width | Description 

ICH_EISR cl2 |4 c8 3 RO | @x@8@000800 | 32-bit | Interrupt Controller End of Interrupt Status Register 

ICH_VMCR 7 RW | 0x004C008@ =| 32-bit | Interrupt Controller Virtual Machine Control Register 

ICH_ELRSR 5 RO | @x@@80@80F | 32-bit | Interrupt Controller Empty List Register Status 
Register 

ICH_LRO cl2 JO RW | 0x00000000 = | 32-bit | Interrupt Controller List Register 0 

ICH_LR1 1 RW | 0x@0@800880 = | 32-bit | Interrupt Controller List Register 1 

ICH_LR2 2 RW |@©x00000000 |32-bit | Interrupt Controller List Register 2 

ICH_LR3 3 RW |@©x00000000 |32-bit | Interrupt Controller List Register 3 

ICH_LRCO cl4 JO RW | 0x00@800080 = | 32-bit | Interrupt Controller List Register 0 

ICH_LRC1 1 RW | 0x00000000 = | 32-bit | Interrupt Controller List Register 1 

ICH_LRC2 2 RW | 0x@@800080 = | 32-bit | Interrupt Controller List Register 2 

ICH_LRC3 3 RW | 0x00000000 = | 32-bit | Interrupt Controller List Register 3 

ICC_MCTLR 6 cl2 |4 RW | 0x00000400 = | 32-bit | Interrupt Control Register for EL3 

ICC_MSRE 5 RW | 0x@8@000880 | 32-bit | System Register Enable Register for EL3 

ICC_MGRPEN1 7 RW | 0x00000000 = | 32-bit | Interrupt Controller Monitor Interrupt Group 1 Enable 
register 

4.4.29 AArch64 Generic Timer registers 


See Chapter 9 Generic Timer on page 9-372 for information on the Generic Timer registers. 
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4.4.30 AArch32 Implementation defined registers 
The following table shows the 32-bit wide implementation defined registers. 
These registers provide test features and any required configuration options specific to the Cortex-A73 
processor. 
Table 4-161 Memory access registers 
Name C |Op ICR |O | Reset Widt | Description 
Rn |1 m |p2 h 
L2CTLR c9 |1 c0 |2 |-b 32-bit | 4.5.62 L2 Control Register on page 4-299 
L2ECTLR 3 |0x00000000 32-bit | 4.5.63 L2 Extended Control Register on page 4-302 
CBAR cl |1 c3 |o ļ-bi 32-bit | 4.5.78 Configuration Base Address Register on page 4-317 
5 - 
CDBGDRO 35% |cO |0 |UNK 32-bit | Data Register 0, see 6.7 Direct access to internal memory 
on page 6-337 
CDBGDR1 1 |UNK 32-bit | Data Register 1, see 6.7 Direct access to internal memory 
on page 6-337 
CDBGDR2 2 |UNK 32-bit | Data Register 2, see 6.7 Direct access to internal memory 
on page 6-337 
ECTLR - 1 c15 |- | 0x00000580 32-bit | 4.5.76 Extended Control Register on page 4-314 
L2MERRSR |- 3 c15 |- | OxX00OOOOOOOOO | 64-bit | 4.5.77 L2 Memory Error Syndrome Register on page 4-316 
000000 
4.4.31 AArch32 Implementation defined operations 
The following table shows the implementation defined operations in AArch32 state. 
Table 4-162 Memory access registers 
Name C |Op ICR |O |Reset Widt | Description 
Rn |1 m |p2 h 
DCCIALL cl |1 c14 |0 | UNK 32-bit | 4.5.79 DCCIALL Clean Invalidate All on page 4-318 
5 
CDBGDCT 3 c2 |0 |UNK 32-bit | Data Cache Tag Read Operation Register, see 6.7 Direct access to 
internal memory on page 6-337 
CDBGICT 1 | UNK 32-bit | Instruction Cache Tag Read Operation Register, see 6.7 Direct 
access to internal memory on page 6-337 
CDBGDCD c4 |0 |UNK 32-bit | Data Cache Data Read Operation Register, see 6.7 Direct access to 
internal memory on page 6-337 
CDBGICD 1 |UNK 32-bit | Instruction Cache Data Read Operation Register, see 6.7 Direct 
access to internal memory on page 6-337 
CDBGTD 2 |UNK 32-bit | TLB Data Read Operation Register, see 6.7 Direct access to 
internal memory on page 6-337 
bi The reset value depends on the processor configuration. 


bj See 6.7 Direct access to internal memory on page 6-337 for information on how these registers are used. 
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4.5 AArch32 register descriptions 
This section describes all the CP15 system registers in register number order. 
See 4.4.1 c0 registers on page 4-190 and 4.4.28 AArch32 GIC system registers on page 4-210, which 
provide cross-references to individual registers. 
This section contains the following subsections: 
4.5.1 Main ID Register on page 4-214. 
4.5.2 Multiprocessor Affinity Register on page 4-215. 
4.5.3 Revision ID Register on page 4-217. 
4.5.4 TCM Type Register on page 4-218. 
4.5.5 TLB Type Register on page 4-218. 
4.5.6 Processor Feature Register 0 on page 4-218. 
4.5.7 Processor Feature Register 1 on page 4-219. 
4.5.8 Debug Feature Register 0 on page 4-220. 
4.5.9 Auxiliary Feature Register 0 on page 4-221. 
4.5.10 Memory Model Feature Register 0 on page 4-221. 
4.5.11 Memory Model Feature Register 1 on page 4-223. 
4.5.12 Memory Model Feature Register 2 on page 4-224. 
4.5.13 Memory Model Feature Register 3 on page 4-226. 
4.5.14 Instruction Set Attribute Register 0 on page 4-228. 
4.5.15 Instruction Set Attribute Register I on page 4-229. 
4.5.16 Instruction Set Attribute Register 2 on page 4-231. 
4.5.17 Instruction Set Attribute Register 3 on page 4-233. 
4.5.18 Instruction Set Attribute Register 4 on page 4-234. 
4.5.19 Instruction Set Attribute Register 5 on page 4-236. 
4.5.20 Memory Model Feature Register 4 on page 4-238. 
4.5.21 Cache Size ID Register on page 4-238. 
4.5.22 Cache Level ID Register on page 4-240. 
4.5.23 Auxiliary ID Register on page 4-242. 
4.5.24 Cache Size Selection Register on page 4-242. 
4.5.25 Cache Type Register on page 4-243. 
4.5.26 Virtualization Processor ID Register on page 4-244. 
4.5.27 Virtualization Multiprocessor ID Register on page 4-245. 
4.5.28 System Control Register on page 4-246. 
4.5.29 Auxiliary Control Register on page 4-249. 
4.5.30 Architectural Feature Access Control Register on page 4-250. 
4.5.31 Secure Configuration Register on page 4-252. 
4.5.32 Secure Debug Enable Register on page 4-254. 
4.5.33 Non-Secure Access Control Register on page 4-255. 
4.5.34 Secure Debug Configuration Register on page 4-256. 
4.5.35 Hyp Auxiliary Control Register on page 4-258. 
4.5.36 Hyp System Control Register on page 4-259. 
4.5.37 Hyp Configuration Register on page 4-262. 
4.5.38 Hyp Configuration Register 2 on page 4-266. 
4.5.39 Hyp Debug Control Register on page 4-267. 
4.5.40 Hyp Architectural Feature Trap Register on page 4-270. 
4.5.41 Translation Table Base Register 0 on page 4-272. 
4.5.42 Translation Table Base Register 1 on page 4-275. 
4.5.43 Translation Table Base Control Register on page 4-277. 
4.5.44 Hyp Translation Control Register on page 4-280. 
4.5.45 Virtualization Translation Control Register on page 4-282. 
4.5.46 Domain Access Control Register on page 4-283. 
4.5.47 Hyp System Trap Register on page 4-284. 
4.5.48 Hyp Auxiliary Configuration Register on page 4-287. 
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¢ 4.5.49 Data Fault Status Register on page 4-287. 

e 4.5.50 Instruction Fault Status Register on page 4-291. 

¢ 4.5.51 Auxiliary Data Fault Status Register on page 4-294. 

¢ 4.5.52 Auxiliary Instruction Fault Status Register on page 4-294. 

© 4.5.53 Hyp Auxiliary Data Fault Status Syndrome Register on page 4-294. 
© 4.5.54 Hyp Auxiliary Instruction Fault Status Syndrome Register on page 4-294. 
© 4.5.55 Hyp Syndrome Register on page 4-294. 

e 4.5.56 Data Fault Address Register on page 4-295. 

e 4.5.57 Instruction Fault Address Register on page 4-296. 

e 4.5.58 Hyp Data Fault Address Register on page 4-297. 

e 4.5.59 Hyp Instruction Fault Address Register on page 4-298. 

e 4.5.60 Hyp IPA Fault Address Register on page 4-299. 

e 4.5.61 Physical Address Register on page 4-299. 

e 4.5.62 L2 Control Register on page 4-299. 

e 4.5.63 L2 Extended Control Register on page 4-302. 

¢ 4.5.64 Primary Region Remap Register on page 4-304. 

e 4.5.65 Memory Attribute Indirection Registers 0 and 1 on page 4-307. 

¢ 4.5.66 Normal Memory Remap Register on page 4-309. 

e 4.5.67 Auxiliary Memory Attribute Indirection Register 0 on page 4-310. 

¢ 4.5.68 Auxiliary Memory Attribute Indirection Register 1 on page 4-310. 

e 4.5.69 Hyp Auxiliary Memory Attribute Indirection Register 0 on page 4-310. 
e 4.5.70 Hyp Auxiliary Memory Attribute Indirection Register 1 on page 4-310. 
e 4.5.71 Vector Base Address Register on page 4-310. 

e 4.5.72 Reset Management Register on page 4-311. 

e 4.5.73 Interrupt Status Register on page 4-312. 

¢ 4.5.74 Hyp Vector Base Address Register on page 4-313. 

e 4.5.75 FCSE Process ID Register on page 4-314. 

e 4.5.76 Extended Control Register on page 4-314. 

e 4.5.77 L2 Memory Error Syndrome Register on page 4-316. 

e 4.5.78 Configuration Base Address Register on page 4-317. 

e 4.5.79 DCCIALL Clean Invalidate All on page 4-318. 


4.5.1 Main ID Register 
The MIDR characteristics are: 


Purpose Provides identification information for the processor, including an implementer code 
for the device and a device ID number. 


Usage constraints This register is accessible as follows: 








ELO |ELO|EL1 | EL1 | EL2| EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO IRO |RO |RO RO 


























Configurations The MIDR is: 


e Architecturally mapped to the AArch64 MIDR_ELI register. See 
4.3.2 Multiprocessor Affinity Register on page 4-82. 
e Architecturally mapped to external MIDR_ ELI register. 


Attributes MIDR is a 32-bit register. 


The following figure shows the MIDR bit assignments. 
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31 24 23 20:19 16.15 4 3 0 


Figure 4-76 MIDR bit assignments 
The following table shows the MIDR bit assignments. 


Table 4-163 MIDR bit assignments 


Bits Name Function 





[31:24] | Implementer | Indicates the implementer code. This value is: 


0x41 ASCII character 'A' - implementer is ARM Limited. 





[23:20] | Variant Indicates the variant number of the processor. This is the major revision number n in the rn part of the rnpn 
description of the product revision status. This value is: 


Ox@ r0p2. 





[19:16] | Architecture | Indicates the architecture code. This value is: 


OxF Defined by CPUID scheme. 





[15:4] | PartNum Indicates the primary part number. This value is: 


@xD@9 Cortex-A73 processor. 





[3:0] Revision Indicates the minor revision number of the processor. This is the minor revision number n in the pn part of the 
rnpn description of the product revision status. This value is: 


0x2 r0p2. 

















To access the MIDR: 


MRC p15, ©, <Rt>, c@, c@, @; Read MIDR into Rt 
Register access is encoded as follows: 


Table 4-164 MIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 |0000 | 0000 | 000 





The MIDR can be accessed through the external debug interface, offset @xDee. 


4.5.2 Multiprocessor Affinity Register 
The MPIDR characteristics are: 
Purpose Provides an additional core identification mechanism for scheduling purposes in a 
cluster. 
EDDEVAFFO is a read-only copy of MPIDR accessible from the external debug 
interface. 


Usage constraints This register is accessible as follows: 























ELO | EL1 | EL2 
- RO |RO 
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Traps and Enables There are no traps or enables affecting this register. 
Configurations The internal MPIDR is architecturally mapped to external EDDEVAFFO register. 


There is one copy of this register that is used. 


Attributes MPIDR is a 32-bit register. 


The following figure shows the MPIDR bit assignments. 


31 30 29 25 24 23 16 15 8 7 21 0 
MT— 


Figure 4-77 MPIDR bit assignments 


The following table shows the MPIDR bit assignments. 


Table 4-165 MPIDR bit assignments 






































Bits |Name | Function 

[31] M RESI. 

[30] U Indicates a single core system, as distinct from core 0 in a cluster. This value is: 
(2 Core is part of a cluster. 

[29:25] | - Reserved, RESO. 

[24] MT Indicates whether the lowest level of affinity consists of logical cores that are implemented using a multi-threading 
type approach. This value is: 
(2) CPU does not support a multi-threaded micro-architecture. 

[23:16] | Aff2 | Affinity level 2. Second highest level affinity field. 
Indicates the value read in the CLUSTERIDAFF?2 configuration signal. 

[15:8] | Affl | Affinity level 1. Third highest level affinity field. 
Indicates the value read in the CLUSTERIDAFF1 configuration signal. 

[7:2] RAZ |Read as zero. 

[1:0] |Aff0 | Affinity level 0. Lowest level affinity field. 


Indicates the core number in the Cortex-A73 processor. The possible values are: 


0x0 


0x0 
0x1 
0x0 
0x1 
0x2 
0x0 
0x1 
0x2 
0x3 


A processor with one core only. 


A cluster with two cores. 


A cluster with three cores. 


A cluster with four cores. 
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4.5.3 


To access the MPIDR: 


MRC p15,0,<Rt>,c@,c@,5 ; Read MPIDR into Rt 


Register access is encoded as follows: 


The EDDEVAFFO can be accessed through the external debug interface, offset @xFA8. 


Revision ID Register 


The REVIDR characteristics are: 


4 System Control 


4.5 AArch32 register descriptions 


Table 4-166 MPIDR access encoding 





coproc 


opc1 


CRn | CRm | opc2 











1111 


000 











0000 | 0000 | 101 





Purpose Provides implementation-specific minor revision information that can be interpreted 
only in conjunction with the Main ID Register. 


Usage This register is accessible as follows: 





constraints 
ELO 


(NS) 


ELO 


EL1 
(NS) 


EL1 
(S) 


EL2 | EL3 


(SCR.NS = 1) | (SCR.NS = 0) 


EL3 














RO 





RO 





RO |RO 


RO 











Configurations REVIDR is architecturally mapped to AArch64 register REVIDR_EL1. See 
4.3.3 Revision ID Register on page 4-84. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes REVIDR is a 32-bit register. 


The following figure shows the REVIDR bit assignments. 


31 


0 


Figure 4-78 REVIDR bit assignments 


The following table shows the REVIDR bit assignments. 


Table 4-167 REVIDR bit assignments 





Bits 


Name 


Function 





[31:0] 








ID number 


implementation. 


0x00000000 





Revision code is zero. 


Implementation-specific revision information. The reset value is determined by the specific Cortex-A73 MPCore 








To access the REVIDR: 


MRC p15, ©, <Rt>, c@, c@, 6; Read REVIDR into Rt 


Register access is encoded as follows: 
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Table 4-168 REVIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 | 0000 | 0000 | 110 






























































4.5.4 TCM Type Register 
The processor does not implement the features described by the TCMTR, so this register is always RAZ. 
4.5.5 TLB Type Register 
The processor does not implement the features described by the TLBTR, so this register is always RAZ. 
4.5.6 Processor Feature Register 0 
The ID_PFRO characteristics are: 
Purpose Gives top-level information about the instruction sets supported by the processor in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO ELO EL1 EL1 EL2 EL3 EL3 
(NS) |(S) (NS) | (S) (SCR.NS =1) | (SCR.NS = 0) 
- - RO RO RO RO RO 
ID_PFRO must be interpreted with ID_PFR1I. 
Configurations ID _PFRO is architecturally mapped to AArch64 register ID_PFRO_EL1. See 
4.3.4 AArch32 Processor Feature Register 0 on page 4-85. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_PFR0O is a 32-bit register. 
The following figure shows the ID_PFRO bit assignments. 
31 16 15 12 11 8 7 4 3 0 
Figure 4-79 ID_PFRO bit assignments 
The following table shows the ID_PFRO bit assignments. 
Table 4-169 ID_PFRO bit assignments 
Bits |Name | Function 
[31:16] | - Reserved, RESO. 
[15:12] | State3 | Indicates support for Thumb Execution Environment (T32EE) instruction set. This value is: 
0x0 Processor does not support the T32EE instruction set. 
[11:8] | State2 | Indicates support for Jazelle. This value is: 
0x1 Processor supports trivial implementation of Jazelle. 
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Table 4-169 ID_PFRO bit assignments (continued) 





Bits Name | Function 





[7:4] Statel | Indicates support for T32 instruction set. This value is: 


0x3 Processor supports T32 encoding after the introduction of Thumb-2 technology, and for all 16-bit and 32- 
bit T32 basic instructions. 





[3:0] State0 | Indicates support for A32 instruction set. This value is: 


@x1 A32 instruction set implemented. 

















To access the ID_PFRO: 


MRC p15,0,<Rt>,c@,c1,@ ; Read ID_PFR@ into Rt 


Register access is encoded as follows: 


Table 4-170 ID_PFRO access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0001 | 000 




















4.5.7 Processor Feature Register 1 
The ID_PFR1 characteristics are: 








Purpose Provides information about the programmers model and architecture extensions 
supported by the processor. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Must be interpreted with ID_PFRO. 


Configurations ID PFRI is architecturally mapped to AArch64 register ID PFR1 ELI. See 
4.3.5 AArch32 Processor Feature Register I on page 4-86. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ID_PFR1 is a 32-bit register. 


The following figure shows the ID_PFR1 bit assignments. 


31 28 27 24 23 20 19 16 15 12 11 8 


7 4 3 0 


Virtualization— 


Figure 4-80 ID_PFR1 bit assignments 
The following table shows the ID_PFR1 bit assignments. 
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Table 4-171 ID_PFR1 bit assignments 


































































































Bits |Name Function 
[31:28] | GIC CPU GIC CPU support: 
0x0 GIC CPU interface is disabled, GICCDISABLE is HIGH. 
0x1 GIC CPU interface is enabled, GICCDISABLE is LOW. 
[27:20] | - Reserved, RESO. 
[19:16] | GenTimer Generic Timer support: 
@x1 Generic Timer implemented. 
[15:12] | Virtualization | Indicates support for Virtualization: 
0x1 Virtualization implemented. 
[11:8] | MProgMod |M profile programmers' model support: 
0x0 Not supported. 
[7:4] Security Security support: 
0x1 Security implemented. This includes support for Monitor mode and the SMC instruction. 
[3:0] | ProgMod Indicates support for the standard programmers model for ARMv4 and later. 
Model must support User, FIQ, IRQ, Supervisor, Abort, Undefined and System modes: 
0x1 Supported. 
To access the ID_PFR1: 
MRC p15,0,<Rt>,c@,c1,1 ; Read ID_PFR1 into Rt 
Register access is encoded as follows: 
Table 4-172 ID_PFR1 access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 |0000 |0001 |001 
4.5.8 Debug Feature Register 0 
The ID_DFRO characteristics are: 
Purpose Provides top level information about the debug system in AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Must be interpreted with the Main ID Register, MIDR. 
Configurations ID_DFRO is architecturally mapped to AArch64 register ID_DFRO_EL1. See 
4.3.6 AArch32 Debug Feature Register 0 on page 4-87. 
There is one copy of this register that is used in both Secure and Non-secure states. 
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Attributes ID_DFR0 is a 32-bit register. 


The following figure shows the ID_DFRO bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Figure 4-81 ID_DFRO bit assignments 
The following table shows the ID_DFRO bit assignments. 


Table 4-173 ID_DFRO bit assignments 





Bits Name Function 





[31:28] Reserved, RESO. 





[27:24] | PerfMon | Indicates support for performance monitor model: 


@x3 Support for Performance Monitor Unit version 3 (PMUV3) system registers. 





[23:20] | MProfDbg | Indicates support for memory-mapped debug model for M profile processors: 


0x0 Processor does not support M profile Debug architecture. 





[19:16] | MMapTrc | Indicates support for memory-mapped trace model: 


0x1 Support for ARM trace architecture, with memory-mapped access. 


In the Trace registers, the ETMIDR gives more information about the implementation. 





[15:12] | CopTre Indicates support for coprocessor-based trace model: 


@x® Processor does not support ARM trace architecture, with CP14 access. 





[11:8] |- Reserved, RAZ. 





[7:4] CopSDbg | Indicates support for coprocessor-based Secure debug model: 


0x6 Processor supports v8 Debug architecture, with CP14 access. 





[3:0] CopDbg | Indicates support for coprocessor-based debug model: 


0x6 Processor supports v8 Debug architecture, with CP14 access. 

















To access the ID_DFRO: 


MRC p15,0,<Rt>,c@,c1,2 ; Read ID_DFR@ into Rt 


Register access is encoded as follows: 


Table 4-174 ID_DFRO access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0001 | 010 




















4.5.9 Auxiliary Feature Register 0 


This register is always RESO. 


4.5.10 Memory Model Feature Register 0 
The ID MMEFR0O characteristics are: 
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Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Must be interpreted with ID MMFR1, ID MMFR2, and ID MMER3. See: 
e 4.5.11 Memory Model Feature Register 1 on page 4-223. 
e 4.5.12 Memory Model Feature Register 2 on page 4-224. 
e 4.5.13 Memory Model Feature Register 3 on page 4-226. 
Configurations ID MMFRO is architecturally mapped to AArch64 register ID MMFRO ELI. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_MMER0O is a 32-bit register. 


The following figure shows the ID_ MMFR0O bit assignments. 


28 27 24 23 20 19 


16 15 


12 11 


FOSE json | Tom | ShareLvi | Outershr | Pmsa | VMSA 


Figure 4-82 ID_MMFRO bit assignments 


The following table shows the ID_ MMFRO bit assignments. 


Table 4-175 ID_MMFR0O bit assignments 



































@x1 





Implemented with hardware coherency support. 


Bits |Name_ | Function 

[31:28] | InnerShr | Indicates the innermost shareability domain implemented: 
0x1 Implemented with hardware coherency support. 

[27:24] | FCSE Indicates support for Fast Context Switch Extension (FCSE): 
0x0 Not supported. 

[23:20] | AuxReg | Indicates support for Auxiliary registers: 
0x2 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary Control Register. 

[19:16] | TCM Indicates support for TCMs and associated DMAs: 
@x® Not supported. 

[15:12] | ShareLvl | Indicates the number of shareability levels implemented: 
@x1 Two levels of shareability implemented. 

[11:8] | OuterShr | Indicates the outermost shareability domain implemented: 
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Table 4-175 ID_MMFR0O bit assignments (continued) 



















































































Bits |Name_ | Function 
[7:4] |PMSA _ | Indicates support for a Protected Memory System Architecture (PMSA): 
@x® Not supported. 
[3:0] | VMSA __ | Indicates support for a Virtual Memory System Architecture (VMSA). 
0x5 Support for: 
e VMSAv7, with support for remapping and the Access flag. 
e The PXN bit in the Short-descriptor translation table format descriptors. 
¢ The Long-descriptor translation table format. 
To access the ID MMFRO: 
MRC p15,0,<Rt>,c@,c1,4 ; Read ID_MMFR@ into Rt 
Register access is encoded as follows: 
Table 4-176 ID_MMFR0O access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 |0001 | 100 
4.5.11 Memory Model Feature Register 1 
The ID_ MMFRI characteristics are: 
Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO [RO |RO |RO RO 
Must be interpreted with ID MMFRO, ID MMFR2, and ID MMER3. See: 
¢ 4.5.10 Memory Model Feature Register 0 on page 4-221. 
e 4.5.12 Memory Model Feature Register 2 on page 4-224. 
e 4.5.13 Memory Model Feature Register 3 on page 4-226. 
Configurations ID MMFR1 is architecturally mapped to AArch64 register ID MMFRI1 ELI. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_MMER1 is a 32-bit register. 
The following figure shows the ID_ MMFR1 bit assignments. 
28 27 2423 20:19 16 15 12 11 
Figure 4-83 ID_MMFR1 bit assignments 
The following table shows the ID MMFR1 bit assignments. 
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Table 4-177 ID_MMFR1 bit assignments 










































































Bits Name Function 
[31:28] | BPred Indicates branch predictor management requirements: 
0x4 For execution correctness, branch predictor requires no flushing at any time. 
[27:24] | L1TstCln | Indicates the supported L1 Data cache test and clean operations, for Harvard or unified cache implementation: 
0x0 None supported. 
[23:20] | L1Uni Indicates the supported entire L1 cache maintenance operations, for a unified cache implementation: 
0x0 None supported. 
[19:16] | LIHvd Indicates the supported entire L1 cache maintenance operations, for a Harvard cache implementation: 
@x@ None supported. 
[15:12] | L1UniSW | Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache implementation: 
@x® None supported. 
[11:8] | L1HvdSW | Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache implementation: 
0x0 None supported. 
[7:4] L1UniVA | Indicates the supported L1 cache line maintenance operations by MVA, for a unified cache implementation: 
0x0 None supported. 
[3:0] L1HvdVA | Indicates the supported L1 cache line maintenance operations by MVA, for a Harvard cache implementation: 
0x0 None supported. 
To access the ID_MMFRI1: 
MRC p15, ©, <Rt>, c@, c1, 5; Read ID_MMFR1 into Rt 
Register access is encoded as follows: 
Table 4-178 ID_MMFR1 access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0001 | 101 
4.5.12 Memory Model Feature Register 2 
The ID MMEFR2 characteristics are: 
Purpose Provides information about the implemented memory model and memory 
management support in AArch32. 
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Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - RO |RO [RO |RO RO 


























Must be interpreted with ID MMFRO, ID MMFRI, and ID MMFR3. See: 


¢ 4.5.10 Memory Model Feature Register 0 on page 4-221. 
e 4.5.11 Memory Model Feature Register 1 on page 4-223. 
e 4.5.13 Memory Model Feature Register 3 on page 4-226 


Configurations ID MMFR2 is architecturally mapped to AArch64 register ID MMFR2_ ELI. 
There is one copy of this register that is used in both Secure and Non-secure states. 

Attributes ID_MMER2 is a 32-bit register. 

The following figure shows the ID_ MMFR2 bit assignments. 


28 27 24 23 2019 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB |LL1HvdRng| L1HvdBG | L1HvdFG 


Figure 4-84 ID_MMFR2 bit assignments 
The following table shows the ID_MMFR2 bit assignments. 


Table 4-179 ID_MMFR2 bit assignments 





Bits Name Function 





[31:28] | HWAccFlg | Hardware Access Flag. Indicates support for a Hardware Access flag, as part of the VMSAv7 implementation: 


0x0 Not supported. 





[27:24] | WFIStall Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFYI) stalling: 
0x1 Support for WFI stalling. 








[23:20] | MemBarr Memory Barrier. Indicates the supported CP15 memory barrier operations. 


0x2 Supported CP15 memory barrier operations are: 
e Data Synchronization Barrier (DSB). 
¢ Instruction Synchronization Barrier (ISB). 
¢ Data Memory Barrier (DMB). 





[19:16] | UniTLB Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB implementation. 


@x6 Supported unified TLB maintenance operations are: 
e Invalidate all entries in the TLB. 
e Invalidate TLB entry by MVA. 
e Invalidate TLB entries by ASID match. 
e Invalidate instruction TLB and data TLB entries by MVA All ASID. This is a shared unified 
TLB operation. 
e Invalidate Hyp mode unified TLB entry by MVA. 
e Invalidate entire Non-secure EL1 and ELO unified TLB. 
e Invalidate entire Hyp mode unified TLB. 
e TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 
e TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPAS2L. 
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Table 4-179 ID_MMFR2 bit assignments (continued) 

























































































Bits |Name Function 
[15:12] | HvdTLB Harvard TLB. Indicates the supported TLB maintenance operations, for a Harvard TLB implementation: 
0x0 Not supported. 
[11:8] | LL1HvdRng | L1 Harvard cache Range. Indicates the supported L1 cache maintenance range operations, for a Harvard cache 
implementation: 
0x0 Not supported. 
[7:4] L1HvdBG |L1 Harvard cache Background fetch. Indicates the supported L1 cache background prefetch operations, for a 
Harvard cache implementation: 
0x0 Not supported. 
[3:0] L1HvdFG L1 Harvard cache Foreground fetch. Indicates the supported L1 cache foreground prefetch operations, for a 
Harvard cache implementation: 
0x0 Not supported. 
To access the ID_MMFR2: 
MRC p15,0,<Rt>,c@,c1,6 ; Read ID_MMFR2 into Rt 
Register access is encoded as follows: 
Table 4-180 ID_MMFR2 access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 |0000 |0001 |110 
4.5.13 Memory Model Feature Register 3 
The ID_MMFR3 characteristics are: 
Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
Must be interpreted with ID_MMFRO, ID_MMFRI], and ID_MMFR2. See: 
¢ 4.5.10 Memory Model Feature Register 0 on page 4-221 
e 4.5.11 Memory Model Feature Register 1 on page 4-223 
e 4.5.12 Memory Model Feature Register 2 on page 4-224 
Configurations ID MMFR3 is architecturally mapped to AArch64 register ID MMFR3_EL1. See 
4.3.11 AArch32 Memory Model Feature Register 3 on page 4-93. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_MMER3 is a 32-bit register. 
The following figure shows the ID_ MMEFR3 bit assignments. 
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31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





Figure 4-85 ID_MMFR3 bit assignments 
The following table shows the ID_MMFR3 bit assignments. 


Table 4-181 ID_MMFR3 bit assignments 


Bits Name Function 





[31:28] | Supersec | Supersections. Indicates support for supersections: 


0x0 Supersections supported. 





[27:24] | CMemSz | Cached Memory Size. Indicates the size of physical memory supported by the processor caches: 
0x2 1TByte, corresponding to a 40-bit physical address range. 








[23:20] | CohWalk | Coherent walk. Indicates whether translation table updates require a clean to the point of unification: 


0x1 Updates to the translation tables do not require a clean to the point of unification to ensure visibility 
by subsequent translation table walks. 





[19:16] | - Reserved, RESO. 





[15:12] | MaintBest | Maintenance broadcast. Indicates whether cache, TLB and branch predictor operations are broadcast: 


0x2 Cache, TLB and branch predictor operations affect structures according to shareability and defined 
behavior of instructions. 





[11:8] |BPMaint | Branch predictor maintenance. Indicates the supported branch predictor maintenance operations. 


0x2 Supported branch predictor maintenance operations are: 


e Invalidate all branch predictors. 
e Invalidate branch predictors by MVA. 





[7:4] CMaintSW | Cache maintenance by set/way. Indicates the supported cache maintenance operations by set/way. 


@x1 Supported hierarchical cache maintenance operations by set/way are: 
e Invalidate data cache by set/way. 
e Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 





[3:0] | CMaintVA | Cache maintenance by MVA. Indicates the supported cache maintenance operations by MVA. 


@x1 Supported hierarchical cache maintenance operations by MVA are: 
e Invalidate data cache by MVA. 


Invalidate data cache by MVA operations are treated as clean and invalidate data cache by MVA 
operations on the executing core. If the operation is broadcast to another core then it is broadcast 
as an invalidate data cache by MVA operation. 

e Clean data cache by MVA. 

e Clean and invalidate data cache by MVA. 

e Invalidate instruction cache by MVA. 

¢ Invalidate all instruction cache entries. 

















To access the ID MMEFR3: 


MRC p15, ©, <Rt>, c@, c1, 7; Read ID_MMFR3 into Rt 
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Register access is encoded as follows: 


Table 4-182 ID_MMFR3 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000} 0001 | 111 



















































































4.5.14 Instruction Set Attribute Register 0 
The ID_ISARO characteristics are: 
Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO [RO |RO |RO RO 
Must be interpreted with ID ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, and 
ID_ISARS. See: 
e 4.5.15 Instruction Set Attribute Register I on page 4-229. 
¢ 4.5.16 Instruction Set Attribute Register 2 on page 4-231. 
¢ 4.5.17 Instruction Set Attribute Register 3 on page 4-233. 
¢ 4.5.18 Instruction Set Attribute Register 4 on page 4-234. 
¢ 4.5.19 Instruction Set Attribute Register 5 on page 4-236. 
Configurations ID_ISARO is architecturally mapped to AArch64 register ID ISARO ELI. See 
4.3.12 AArch32 Instruction Set Attribute Register 0 on page 4-94. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_ISAR0O is a 32-bit register. 
The following figure shows the ID_ISARO bit assignments. 
31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 
Figure 4-86 ID_ISARO bit assignments 
The following table shows the ID_ISARO bit assignments. 
Table 4-183 ID_ISARO bit assignments 
Bits /Name Function 
[31:28] | - Reserved, RESO. 
[27:24] | Divide Indicates the implemented Divide instructions: 
0x2 e SDIV and UDIV in the T32 instruction set. 
e SDIV and UDIV in the A32 instruction set. 
[23:20] | Debug Indicates the implemented Debug instructions: 
0x1 BKPT. 
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Table 4-183 ID_ISARO bit assignments (continued) 



























































Bits |Name Function 
[19:16] | Coproc Indicates the implemented Coprocessor instructions: 
@x® None implemented, except for separately attributed by the architecture including CP15, CP14, 
Advanced SIMD and Floating-point. 
[15:12] | CmpBranch | Indicates the implemented combined Compare and Branch instructions in the T32 instruction set: 
@x1 CBNZ and CBZ. 
[11:8] | Bitfield Indicates the implemented bit field instructions: 
0x1 BFC, BFI, SBFX, and UBFX. 
[7:4] | BitCount Indicates the implemented Bit Counting instructions: 
0x1 CLZ. 
[3:0] Swap Indicates the implemented Swap instructions in the A32 instruction set: 
0x0 None implemented. 
To access the ID_ISARO: 
MRC p15, ©, <Rt>, c@, c2, @ ; Read ID_ISAR@ into Rt 
Register access is encoded as follows: 
Table 4-184 ID_ISARO access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 |0000 |0010 |000 
4.5.15 Instruction Set Attribute Register 1 


The ID_ISARI characteristics are: 


Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 
































Must be interpreted with ID ISARO, ID ISAR2, ID_ISAR3, ID_ISAR4 and 
ID_ISARS. See: 

¢ 4.5.14 Instruction Set Attribute Register 0 on page 4-228. 

¢ 4.5.16 Instruction Set Attribute Register 2 on page 4-231. 

¢ 4.5.17 Instruction Set Attribute Register 3 on page 4-233. 

¢ 4.5.18 Instruction Set Attribute Register 4 on page 4-234. 

¢ 4.5.19 Instruction Set Attribute Register 5 on page 4-236. 
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Configurations [ID _ISAR1 is architecturally mapped to AArch64 register ID ISAR1_ ELI. See 
4.3.13 AArch32 Instruction Set Attribute Register 1 on page 4-95. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_ISARI is a 32-bit register. 
The following figure shows the ID_ISAR1 bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Figure 4-87 ID_ISAR1 bit assignments 
The following table shows the ID_ISAR1 bit assignments. 


Table 4-185 ID_ISAR1 bit assignments 















































Bits /Name Function 
[31:28] | Jazelle Indicates the implemented Jazelle state instructions: 
0x1 The BXJ instruction, and the J bit in the PSR. 
[27:24] | Interwork | Indicates the implemented Interworking instructions: 
0x3 ¢ The BX instruction, and the T bit in the PSR. 
e The BLX instruction. The PC loads have BX-like behavior. 
e Data-processing instructions in the A32 instruction set with the PC as the destination and the S 
bit clear, have BX-like behavior. 
[23:20] | Immediate | Indicates the implemented data-processing instructions with long immediates: 
0x1 ¢ The MOVT instruction. 
¢ The MOV instruction encodings with zero-extended 16-bit immediates. 
¢ The T32 ADD and SUB instruction encodings with zero-extended 12-bit immediates, and other 
ADD, ADR, and SUB encodings cross-referenced by the pseudocode for those encodings. 
[19:16] | IfThen Indicates the implemented If-Then instructions in the T32 instruction set: 
0x1 The IT instructions, and the IT bits in the PSRs. 
[15:12] | Extend Indicates the implemented Extend instructions: 
0x2 ¢ The SXTB, SXTH, UXTB, and UXTH instructions. 
e The SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH instructions. 
[11:8] | Except_AR | Indicates the implemented A profile exception-handling instructions: 
0x1 The SRS and RFE instructions, and the A profile forms of the CPS instruction. 
[7:4] Except Indicates the implemented exception-handling instructions in the A32 instruction set: 
0x1 The LDM (exception return), LDM (user registers), and STM (user registers) instruction versions. 
[3:0] | Endian Indicates the implemented Endian instructions: 
0x1 The SETEND instruction, and the E bit in the PSRs. 
To access the ID_ISAR1: 
MRC p15, ©, <Rt>, c@, c2, 1 ; Read ID_ISAR1 into Rt 
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Table 4-186 ID_ISAR1 access encoding 
































coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000] 0010 | 001 
4.5.16 Instruction Set Attribute Register 2 
The ID_ISAR2 characteristics are: 
Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Must be interpreted with ID ISARO, ID ISAR1, ID_ISAR3, ID_ISAR4 and 


ID_ISARS. See. 


¢ 4.5.14 Instruction Set Attribute Register 0 on page 4-228. 
¢ 4.5.15 Instruction Set Attribute Register 1 on page 4-229. 
¢ 4.5.17 Instruction Set Attribute Register 3 on page 4-233. 
¢ 4.5.18 Instruction Set Attribute Register 4 on page 4-234. 
¢ 4.5.19 Instruction Set Attribute Register 5 on page 4-236. 


Configurations ID_ISAR2 is architecturally mapped to AArch64 register ID ISAR2_ ELI. See 
4.3.14 AArch32 Instruction Set Attribute Register 2 on page 4-97. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ID_ISAR2 is a 32-bit register. 


The following figure shows the ID_ISAR2 bit assignments. 


28 27 24 23 20 19 


MultiAccessint — 


16 15 


The following table shows the ID_ISAR2 bit assignments. 


12 11 


Figure 4-88 ID_ISAR2 bit assignments 
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4 System Control 
4.5 AArch32 register descriptions 


Table 4-187 ID_ISAR2 bit assignments 





Bits 


Name 


Function 





[31:28] 


Reversal 


Indicates the implemented Reversal instructions: 


0x2 


The REV, REV16, and REVSH instructions. 


The RBIT instruction. 





[27:24] 


PSR_AR 


Indicates the implemented A and R profile instructions to manipulate the PSR: 


0x1 


The MRS and MSR instructions, and the exception return forms of data-processing instructions. 





The exception return forms of the data-processing instructions are: 


e Inthe A32 instruction set, data-processing instructions with the PC as the destination and the S bit set. 
¢ Inthe T32 instruction set, the SUBS PC, LR, #N instruction. 


Note 








[23:20] 


MultU 


Indicates the implemented advanced unsigned Multiply instructions: 


0x2 


The UMULL and UMLAL instructions. 


The UMAAL instruction. 





[19:16] 


MultS 


Indicates the implemented advanced signed Multiply instructions. 


0x3 


e The SMULL and SMLAL instructions. 

e The SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, 
SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, and the Q bit in 
the PSRs. 

e The SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, 
SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDxX instructions. 





[15:12] 


Mult 


Indicates the implemented additional Multiply instructions: 


0x2 


The MUL instruction. 
The MLA instruction. 


The MLS instruction. 





[11:8] 


MultiAccessInt 


Indicates the support for interruptible multi-access instructions: 


0x0 


No support. This means the LDM and STM instructions are not interruptible. 





[7:4] 


MemHint 


Indicates the implemented memory hint instructions: 


0x4 


The PLD instruction. 
The PLI instruction. 


The PLDW instruction. 





[3:0] 








LoadStore 





Indicates the implemented additional load/store instructions: 


0x2 


The LDRD and STRD instructions. 


The Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, LDAEX, and LDAEXD) and Store Release 
(STLB, STLH, STL, STLEXB, STLEXH, STLEX, and STLEXD) instructions. 
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4.5 AArch32 register descriptions 


To access the ID_ISAR2: 


MRC p15, ©, <Rt>, c@, c2, 2 ; Read ID_ISAR2 into Rt 


Register access is encoded as follows: 


Table 4-188 ID_ISAR2 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0010 | 010 




















4.5.17 Instruction Set Attribute Register 3 
The ID_ISAR3 characteristics are: 








Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Must be interpreted with ID ISARO, ID_ISARI, ID_ISAR2, ID_ISAR4, and 
ID_ISARS. See: 

¢ 4.5.14 Instruction Set Attribute Register 0 on page 4-228. 

¢ 4.5.15 Instruction Set Attribute Register I on page 4-229. 

¢ 4.5.16 Instruction Set Attribute Register 2 on page 4-231. 

¢ 4.5.18 Instruction Set Attribute Register 4 on page 4-234. 

¢ 4.5.19 Instruction Set Attribute Register 5 on page 4-236. 


Configurations ID_ISAR3 is architecturally mapped to AArch64 register ID ISAR3_ ELI. See 
4.3.15 AArch32 Instruction Set Attribute Register 3 on page 4-99. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ID_ISAR3 is a 32-bit register. 


The following figure shows the ID_ISAR3 bit assignments. 


28 27 24 23 20 19 16 15 12 11 


T32EE TrueNOP |ThumbCopy] TabBranch megj SIMD 


Figure 4-89 ID_ISAR3 bit assignments 
The following table shows the ID_ISAR3 bit assignments. 
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4 System Control 
4.5 AArch32 register descriptions 


Table 4-189 ID_ISAR3 bit assignments 





Bits 


Name 


Function 





[31:28] 


T32EE 


Indicates the implemented Thumb Execution Environment (T32EE) instructions: 


0x0 


None implemented. 





[27:24] 


TrueNOP 


Indicates support for True NOP instructions: 


0x1 


True NOP instructions in both the A32 and T32 instruction sets, and additional NOP-compatible 
hints. 





[23:20] 


ThumbCopy 


Indicates the support for T32 non flag-setting MOV instructions: 


0x1 


register to a low register. 


Support for T32 instruction set encoding T1 of the MOV (register) instruction, copying from a low 





[19:16] 


TabBranch 


Indicates the implemented Table Branch instructions in the T32 instruction set: 


x1 


The TBB and TBH instructions. 





[15:12] 


SynchPrim 


Indicates the implemented Synchronization Primitive instructions: 


0x2 sd 


The LDREX and STREX instructions. 
The CLREX, LDREXB, STREXB, and STREXH instructions. 
The LDREXD and STREXD instructions. 





[11:8] 


SVC 


Indicates the implemented SVC instructions: 


0x1 


The SVC instruction. 





[7:4] 


SIMD 


Indicates the implemented Single Instruction Multiple Data (SIMD) instructions: 


0x3 . 


The SSAT and USAT instructions, and the Q bit in the PSRs. 

The PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, SASX, 
SEL, SHADD16, SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, SSUB8, SSAX, 
SXTAB16, SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, UHSUB16, UHSUB8, 
UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, USAD8, USADA8, USAT16, 
USUB16, USUB8, USAX, UXTAB16, UXTB16 instructions, and the GE[3:0] bits in the PSRs. 





[3:0] 








Saturate 





Indicates the implemented Saturate instructions: 


0x1 


The QADD, QDADD, QDSUB, QSUB and the Q bit in the PSRs. 








4.5.18 


To access the ID_ISAR3: 


MRC p15, ©, <Rt>, c@, c2, 3 ; Read ID_ISAR3 into Rt 


Register access is encoded as follows: 


Table 4-190 ID_ISAR3 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000} 0010 | 011 




















Instruction Set Attribute Register 4 
The ID_ISAR4 characteristics are: 
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Purpose Provides information about the instruction sets implemented by the processor in 
AArch32. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Must be interpreted with ID ISARO, ID ISARI, ID_ISAR2, ID_ISAR3, and 
ID_ISARS. See: 

¢ 4.5.14 Instruction Set Attribute Register 0 on page 4-228. 

¢ 4.5.15 Instruction Set Attribute Register 1 on page 4-229. 

¢ 4.5.16 Instruction Set Attribute Register 2 on page 4-231. 

¢ 4.5.17 Instruction Set Attribute Register 3 on page 4-233. 

¢ 4.5.19 Instruction Set Attribute Register 5 on page 4-236. 


Configurations ID_ISAR4 is architecturally mapped to AArch64 register ID ISAR4 ELI. See 
4.3.16 AArch32 Instruction Set Attribute Register 4 on page 4-100. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes ID_ISAR4 is a 32-bit register. 
The following figure shows the ID_ISAR4 bit assignments. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





SynchPrim_frac — 


Figure 4-90 ID_ISAR4 bit assignments 
The following table shows the ID_ISAR4 bit assignments. 


Table 4-191 ID_ISAR4 bit assignments 






































Bits Name Function 
[31:28] | SWP_ frac Indicates support for the memory system locking the bus for SWP or SWPB instructions: 
Ox@ SWP and SWPB instructions not implemented. 
[27:24] | PSR_M Indicates the implemented M profile instructions to modify the PSRs: 
0x0 None implemented. 
[23:20] | SynchPrim frac | This field is used with the ID_ISAR3.SynchPrim field to indicate the implemented Synchronization 
Primitive instructions: 
0x0 e The LDREX and STREX instructions. 
* The CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
e The LDREXD and STREXD instructions. 
[19:16] | Barrier Indicates the supported Barrier instructions in the A32 and T32 instruction sets: 
0x1 The DMB, DSB, and ISB barrier instructions. 
[15:12] | SMC Indicates the implemented SMC instructions: 
0x1 The SMC instruction. 
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Table 4-191 ID_ISAR4 bit assignments (continued) 





















































Bits |Name Function 
[11:8] | Writeback Indicates the support for writeback addressing modes: 
@x1 Processor supports all of the writeback addressing modes defined in ARMv8. 
[7:4] | WithShifts Indicates the support for instructions with shifts: 
0x4 e Support for shifts of loads and stores over the range LSL 0-3. 
¢ Support for other constant shift options, both on load/store and other instructions. 
¢ Support for register-controlled shift options. 
[3:0] | Unpriv Indicates the implemented unprivileged instructions: 
0x2 * The LDRBT, LDRT, STRBT, and STRT instructions. 
¢ The LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 
To access the ID_ISAR4: 
MRC p15, ©, <Rt>, c@, c2, 4 ; Read ID_ISAR4 into Rt 
Register access is encoded as follows: 
Table 4-192 ID_ISAR4 access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0000 | 0010 | 100 
4.5.19 Instruction Set Attribute Register 5 


The ID_ISARS characteristics are: 


Purpose Provides information about the instruction sets that the processor implements. 


Note 
The optional Cryptographic Extension is not included in the base product. ARM 
supplies the Cryptographic Extension only under an additional license to the Cortex- 
A73 MPCore processor and Advanced SIMD and floating-point support licenses. 











Usage This register is accessible as follows: 

constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO [RO |RO |RO RO 


























ID_ISARS must be interpreted with ID_ISARO, ID_ISARI, ID_ISAR2, ID_ISAR3, 
and ID_ISAR4. See: 

¢ 4.5.14 Instruction Set Attribute Register 0 on page 4-228. 

e 4.5.15 Instruction Set Attribute Register 1 on page 4-229. 

¢ 4.5.16 Instruction Set Attribute Register 2 on page 4-231. 

¢ 4.5.17 Instruction Set Attribute Register 3 on page 4-233. 

¢ 4.5.18 Instruction Set Attribute Register 4 on page 4-234. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-236 
reserved. 
Non-Confidential 


4 System Control 
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Configurations ID_ISARS is architecturally mapped to AArch64 register ID ISAR5_ ELI. See 
4.3.17 AArch32 Instruction Set Attribute Register 5 on page 4-101. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ID_ISARS is a 32-bit register. 
The following figure shows the ID_ISARS bit assignments. 


31 20 19 16 15 12 11 8 


7 4 3 0 


Figure 4-91 ID_ISARS5 bit assignments 
The following table shows the ID_ISARS bit assignments. 


Table 4-193 ID_ISARS5 bit assignments 









































Bits | Name | Function 
[31:20] | - Reserved, RESO. 
[19:16] | CRC32 | Indicates whether CRC32 instructions are implemented in AArch32 state. The value is: 
@x1 CRC32 instructions are implemented. 
[15:12] | SHA2 | Indicates whether SHA2 instructions are implemented in AArch32 state. The possible values are: 
@x@ No SHA2 instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
@x1 SHA256H, SHA256H2, SHA256SU®, and SHA256SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 
[11:8] | SHA1 | Indicates whether SHA1 instructions are implemented in AArch32 state. The possible values are: 
@x@ No SHA instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
0x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 are implemented. This is the value if the 
implementation includes the Cryptographic Extension. 
[7:4] | AES Indicates whether AES instructions are implemented in AArch32 state. The possible values are: 
0x0 No AES instructions are implemented. This is the value if the implementation does not include the 
Cryptographic Extension. 
0x2 AESE, AESD, AESMC, and AESIMC are implemented, plus PMULL and PMULL2 instructions operating on 
64-bit elements. This is the value if the implementation includes the Cryptographic Extension. 
[3:0] SEVL | Indicates whether the SEVL instruction is implemented. The value is: 
@x1 SEVL is implemented to send event local. 
To access the ID_ISARS: 
MRC p15,0,<Rt>,c@,c2,5 ; Read ID_ISARS5 into Rt 
Register access is encoded as follows: 
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Table 4-194 ID_ISAR5 access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 | 0000 | 0010 | 101 





4.5.20 Memory Model Feature Register 4 
The ID_ MMFR4 characteristics are: 








Purpose Provides information about the memory model and memory management support in 
AArch32. 
Usage constraints This register is accessible as follows: 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Configurations ID MMFR4 is architecturally mapped to AArch64 register ID MMFR4 ELI. 
There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ID_MMFR4 is a 32-bit register. 


The following figure shows the ID_ MMFR4 bit assignments. 


31 0 


RESO 


Figure 4-92 ID_MMFR4 bit assignments 
The following table shows the ID_ MMFR4 bit assignments. 


Table 4-195 ID_MMFR4 bit assignments 





Bits | Name | Function 





[31:0] | - Reserved, RESO. 

















To access the ID MMFR4: 


MRC p15,0,<Rt>,c@,c2,6 ; Read ID_MMFR4 into Rt 


Register access is encoded as follows: 


Table 4-196 ID_MMFR4 access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 |0000 |0010 |110 




















4.5.21 Cache Size ID Register 
The CCSIDR characteristics are: 





Purpose Provides information about the architecture of the caches. 
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Configurations 


Attributes 


4 System Control 
4.5 AArch32 register descriptions 


This register is accessible as follows: 








ELO | ELO|EL1 | EL1/EL2|EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO [RO RO 


























If CSSELR indicates a cache that is not implemented, then on a read of the CCSIDR 
the behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 

e The CCSIDR read is treated as NOP. 

e The CCSIDR read is UNDEFINED. 

e The CCSIDR read returns an UNKNOWN value (preferred). 


CCSIDR is architecturally mapped to AArch64 register CCSIDR_EL1. See 
4.3.29 Cache Size ID Register on page 4-110. 


There is one copy of this register that is used in both Secure and Non-secure states. 


The implementation includes one CCSIDR for each cache that it can access. CSSELR 
selects which Cache Size ID Register is accessible. 


CCSIDR is a 32-bit register. 


The following figure shows the CCSIDR bit assignments. 


31 30 29 28 27 13 12 3 2 0 


| NumSets Associativity 


wT — L_ wa LineSize — 
WB RA 





Figure 4-93 CCSIDR bit assignments 


The following table shows the CCSIDR bit assignments. 


Table 4-197 CCSIDR bit assignments 




















Bits |Name Function 
[31] WT Indicates support for Write-Through: 
e Cache level does not support Write-Through. 
[30] WB Indicates support for Write-Back: 
e Cache level does not support Write-Back. 
1 Cache level supports Write-Back. 
[29] RA Indicates support for Read-Allocation: 
e Cache level does not support Read-Allocation. 
1 Cache level supports Read-Allocation. 
[28] WA Indicates support for Write-Allocation: 
e Cache level does not support Write-Allocation. 
1 Cache level supports Write-Allocation. 
[27:13] NumSets?* Indicates the number of sets in cache minus 1. Therefore, a value of 0 indicates 1 set in the cache. The 











number of sets does not have to be a power of 2. 
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Table 4-197 CCSIDR bit assignments (continued) 





Bits Name Function 





[12:3] | Associativity* | Indicates the associativity of cache minus 1. Therefore, a value of 0 indicates an associativity of 1. The 
associativity does not have to be a power of 2. 





[2:0] | LineSize* Indicates the (logy (number of words in cache line)) minus 2: 


b010 16 words per line. 














The following table shows the individual bit field and complete register encodings for the CCSIDR. The 
CSSELR determines which CCSIDR to select. 


Table 4-198 CCSIDR encodings 
























































CSSELR | Cache Size | Complete register Register bit field encoding 
on WT | WB | RA | WA | NumSets | Associativity | LineSize 
0x0 L1 data cache 32KB |0x7007E03A 0 1 1 1 0x3F 0x7 0x2 
64KB |0x7007E07A 0x3F OxF 0x2 
0x1 L1 instruction cache | 64KB |0x201FE01A 0 0 1 0 OxFF 0x3 0x2 
0x2 L2 cache 256KB | 0x701FE07A 0 1 1 1 OxFF OXF 0x2 
512KB | 0x703FE07A Q@x1FF OxF 0x2 
1MB 0x707FE07A 0x3FF OXF 0x2 
2MB 0x70FFE07A 0x7FF OxF 0x2 
4MB 0x71FFE07A OxFFF OXF 0x2 
8MB 0x73FFE07A Ox1FFF OxF 0x2 
0x3-0xF | Reserved - - - - - - - - - 






































To access the CCSIDR: 


MRC p15, 1, <Rt>, c@, c@, @ ; Read CCSIDR into Rt 
Register access is encoded as follows: 


Table 4-199 CCSIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 001 |0000 | 0000 | 000 





4.5.22 Cache Level ID Register 
The CLIDR characteristics are: 


Purpose Identifies: 
¢ The type of cache, or caches, implemented at each level. 
¢ The Level of Coherency and Level of Unification for the cache hierarchy. 





bk For more information about encoding, see Zable 4-198 CCSIDR encodings on page 4-240. 
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Usage This register is accessible as follows: 

constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Configurations CLIDR is architecturally mapped to AArch64 register CLIDR_EL1. See 
4.3.30 Cache Level ID Register on page 4-112. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes CLIDR is a 32-bit register. 
The following figure shows the CLIDR bit assignments. 


313029 2726 2423 2120 9 


8 6 5 3 2 0 


Figure 4-94 CLIDR bit assignments 
The following table shows the CLIDR bit assignments. 


Table 4-200 CLIDR bit assignments 



































Bits |Name_ | Function 
[31:30] | - Reserved, RESO. 
[29:27] | LoUU | Indicates the Level of Unification Uniprocessor for the cache hierarchy: 
@b@e1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or invalidating to 
the point of unification for the processor. 
[26:24] | LoC Indicates the Level of Coherency for the cache hierarchy: 
@be@01 L2 cache not implemented. 
b010 A clean to the point of coherency operation requires the L1 and L2 caches to be cleaned. 
[23:21] | LoUIS | Indicates the Level of Unification Inner Shareable for the cache hierarchy: 
@b@01 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or invalidating to 
the point of unification for the Inner Shareable shareability domain. 
[20:9] |- Reserved, RESO. 
[8:6] | Ctype3>! | Indicates the type of cache if the processor implements L3 cache: 
@beee L3 cache not implemented. 
[5:3] | Ctype2 | Indicates the type of cache if the processor implements L2 cache: 
@beee L2 cache is not implemented. 
@b10@ L2 cache is implemented as a unified cache. 
[2:0] | Ctypel | Indicates the type of cache implemented at L1: 


@b@11 Separate instruction and data caches at L1. 














bl 


If software reads the Cache Type fields from Ctypel upwards, after it has seen a value of @b0@@, no caches exist at further-out levels of the hierarchy. So, for 


example, if Ctype2 is the first Cache Type field with a value of @b0@@, the value of Ctype3 must be ignored. 
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To access the CLIDR: 


MRC p15,1,<Rt>,c@,c@,1 ; Read CLIDR into Rt 


Register access is encoded as follows: 


Table 4-201 CLIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 001 | 0000 | 0000 | 001 




















4.5.23 Auxiliary ID Register 


The processor does not implement AIDR, so this register is always RESO. 


4.5.24 Cache Size Selection Register 
The CSSELR characteristics are: 


Purpose 


Usage 
constraints 


Configurations 


Attributes 


Selects the current CCSIDR, see 4.5.21 Cache Size ID Register on page 4-238, by 
specifying: 

e The required cache level. 

e The cache type, either instruction or data cache. 


This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW | RW | RW RW 


























If the CSSELR level field is programmed to a cache level that is not implemented, 
then a read of CSSELR returns an UNKNOWN value in CSSELR.Level. 


CSSELR (NS) is architecturally mapped to AArch64 register CSSELR_EL1. See 
4.3.32 Cache Size Selection Register on page 4-113. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


CSSELR is a 32-bit register. 


The following figure shows the CSSELR bit assignments. 


Figure 4-95 CSSELR bit assignments 


The following table shows the CSSELR bit assignments. 
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Table 4-202 CSSELR bit assignments 



















































































Bits |Name | Function 
[31:4] | - Reserved, RESO. 
[3:1] | Level?™ | Cache level of required cache: 
@beee L1. 
@bee1 L2. 
0b010-0b111 Reserved. 
[0] InD>™ | Instruction not Data bit: 
e Data or unified cache. 
1 Instruction cache. 
To access the CSSELR: 
MRC p15, 2, <Rt>, c@, c@, @; Read CSSELR into Rt 
MCR p15, 2, <Rt>, c@, c@, @; Write Rt to CSSELR 
Register access is encoded as follows: 
Table 4-203 CSSELR access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 010 | 0000 | 0001 | 000 
4.5.25 Cache Type Register 
The CTR_ELO characteristics are: 
Purpose Provides information about the architecture of the caches. 
Usage constraints This register is accessible as follows: 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
p - [RO |RO [RO |RO RO 
Configurations CTR is architecturally mapped to AArch64 register CTR_ELO. See 4.3.33 Cache 
Type Register on page 4-115. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes CTR is a 32-bit register. 
The following figure shows the CTR bit assignments. 
3130 2827 24 23 20 19 16 15 14 13 4 3 0 
|=| one | exe ]ommne jure] so | nme | 
Lres1 
Figure 4-96 CTR bit assignments 
bm 





The combination of Level=@b@@1 and InD=1 is reserved. 
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The following table shows the CTR bit assignments. 


Table 4-204 CTR bit assignments 





Bits Name Function 














[31] - Reserved, RES1. 

[30:28] | - Reserved, RESO. 

[27:24] | CWG Cache Write-Back granule. Log, of the number of words of the maximum size of memory that can be overwritten 
as a result of the eviction of a cache entry that has had a memory location in it modified: 
0x4 Cache Write-Back granule size is 16 words. 

[23:20] | ERG Exclusives Reservation Granule. Log, of the number of words of the maximum size of the reservation granule 


that has been implemented for the Load-Exclusive and Store-Exclusive instructions: 


0x4 Exclusive reservation granule size is 16 words. 





[19:16] | DminLine | Log» of the number of words in the smallest cache line of all the data and unified caches that the processor 








controls: 
0x4 Smallest data cache line size is 16 words. 

[15:14] | L1lp L1 Instruction cache policy. Indicates the indexing and tagging policy for the L1 Instruction cache: 
0b10 Virtually Indexed Physically Tagged (VIPT). 

[13:4] l- Reserved, RESO. 





[3:0] | IminLine | Log, of the number of words in the smallest cache line of all the instruction (L1) and unified (L2) caches that the 
processor controls. 


0x4 Smallest instruction cache line size is 16 words. 

















To access the CTR: 


MRC p15,0,<Rt>,c@,c@,1 ; Read CTR into Rt 


Register access is encoded as follows: 


Table 4-205 CTR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 000 | 0000 | 0000 | 001 




















4.5.26 Virtualization Processor ID Register 
The VPIDR characteristics are: 








Purpose Holds the value of the Virtualization Processor ID. This is the value returned by 
Non-secure EL] reads of MIDR. See 4.5./ Main ID Register on page 4-214. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: Sal - |RW | RW : 


























Configurations VPIDR is architecturally mapped to AArch64 register VPIDR_EL2. See 
4.3.35 Virtualization Processor ID Register on page 4-117. 
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Attributes VPIDR is a 32-bit register. 
VPIDR resets to the value of MIDR. 


The following figure shows the VPIDR bit assignments. 


31 0 


VPIDR 


Figure 4-97 VPIDR bit assignments 
The following table shows the VPIDR bit assignments. 


Table 4-206 VPIDR bit assignments 


Bits | Name | Function 





[31:0] | VPIDR | MIDR value returned by Non-secure PL1 reads of the MIDR. The MIDR description defines the subdivision of this 
value. See 4.5.1 Main ID Register on page 4-214. 














To access the VPIDR: 


MRC p15,4,<Rt>,c@,c@,@ ; Read VPIDR into Rt 
MCR p15,4,<Rt>,c@,c@,@ ; Write Rt to VPIDR 


Register access is encoded as follows: 


Table 4-207 VPIDR access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 100 |0000 | 0000 | 000 




















4.5.27 Virtualization Multiprocessor ID Register 
The VMPIDR characteristics are: 








Purpose Provides the value of the Virtualization Multiprocessor ID. This is the value returned 
by Non-secure EL1 reads of MPIDR. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
i = | he - |RW | RW z 


























Configurations VMPIDR is architecturally mapped to AArch64 register VMPIDR_EL2[31:0]. See 
4.3.36 Virtualization Multiprocessor ID Register on page 4-117. 


This register is accessible only at EL2 or EL3. 
Attributes VMPIDR is a 32-bit register. 
VMPIDR resets to the value of MPIDR. 


The following figure shows the VMPIDR bit assignments. 
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31 0 
VMPIDR 


Figure 4-98 VMPIDR bit assignments 


The following table shows the VMPIDR bit assignments. 
Table 4-208 VMPIDR bit assignments 










































































Bits | Name Function 
[31:0] | VMPIDR | MPIDR value returned by Non-secure EL1 reads of the MPIDR. The MPIDR description defines the subdivision of 
this value. See 4.5.2 Multiprocessor Affinity Register on page 4-215. 
To access the VMPIDR: 
MRC p15,4,<Rt>,c@,c@,5 ; Read VMPIDR into Rt 
MCR p15,4,<Rt>,cQ,c0,5 ; Write Rt to VMPIDR 
Register access is encoded as follows: 
Table 4-209 VMPIDR access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 100 | 0000 | 0000 | 101 
4.5.28 System Control Register 
The SCTLR characteristics are: 
Purpose Provides the top level control of the system, including its memory system. 
Usage The SCTLR is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: - |RW |RW | RW | RW RW 
Control bits in the SCTLR that are not applicable to a VMSA implementation read as 
the value that most closely reflects that implementation, and ignore writes. 
Some bits in the register are read-only. These bits relate to non-configurable features 
of an implementation, and are provided for compatibility with previous versions of 
the architecture. 
Configurations SCTLR (NS) is architecturally mapped to AArch64 register SCTLR_EL1. See 
4.3.37 System Control Register, EL] on page 4-118. 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 
Attributes SCTLR is a 32-bit register. 
The following figure shows the SCTLR bit assignments. 
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Figure 4-99 SCTLR bit assignments 
The following table shows the SCTLR bit assignments. 
Table 4-210 SCTLR bit assignments 
Bits |Name Function 
[31] - Reserved, RESO. 
[30] TE T32 Exception enable. This bit controls whether exceptions are taken in A32 or T32 state: 
2) Exceptions, including reset, taken in A32 state. 
1 Exceptions, including reset, taken in T32 state. 
The input CFGTE defines the reset value of the TE bit. 
[29] AFE Access Flag Enable. This bit enables use of the AP[0] bit in the translation descriptors as the Access flag. It also 


restricts access permissions in the translation descriptors to the simplified model: 
7) In the translation table descriptors, AP[0] is an access permissions bit. The full range of access 
permissions is supported. No Access flag is implemented. This is the reset value. 


1 In the translation table descriptors, AP[0] is the Access flag. Only the simplified model for access 
permissions is supported. 





[28] TRE TEX remap enable. This bit enables remapping of the TEX[2:1] bits for use as two translation table bits that can 
be managed by the operating system. Enabling this remapping also changes the scheme used to describe the 
memory region attributes in the VMSA: 





























7) TEX remap disabled. TEX[2:0] are used, with the C and B bits, to describe the memory region 
attributes. This is the reset value. 

1 TEX remap enabled. TEX[2:1] are reassigned for use as bits managed by the operating system. The 
TEX[0], C and B bits are used to describe the memory region attributes, with the MMU remap 
registers. 

[27:26] | - Reserved, RESO. 

[25] EE Exception Endianness bit. The value of this bit defines the value of the CPSR.E bit on entry to an exception 
vector, including reset. This value also indicates the endianness of the translation table data for translation table 
lookups: 

(2 Little endian. 
1 Big endian. 
The input CFGEND defines the reset value of the EE bit. 

[24] - Reserved, RESO. 

[23:22] | - Reserved, RES1. 
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Table 4-210 SCTLR bit assignments (continued) 





Bits 


Function 





[21] 


Reserved, RESO. 





[20] 


Unprivileged write permission implies EL1 Execute Never (XN). This bit can be used to require all memory 
regions with unprivileged write permissions to be treated as XN for accesses from software executing at EL1. 
(3] Regions with unprivileged write permission are not forced to be XN, this is the reset value. 


1 Regions with unprivileged write permission are forced to be XN for accesses from software executing 
at EL1. 





[19] 


WXN 


Write permission implies Execute Never (XN). This bit can be used to require all memory regions with write 
permissions to be treated as XN. 


(2 Regions with write permission are not forced to be XN. This is the reset value. 


1 Regions with write permissions are forced to be XN. 





[18] 


nTWE 


Not trap WFE. 


(2) Ifa WFE instruction executed at ELO would cause execution to be suspended, such as if the event 
register is not set and there is not a pending WFE wakeup event, it is taken as an exception to EL1 
using the 0x1 ESR code. 


1 WFE instructions are executed as normal. 


The reset value is 0b1. 





[17] 


Reserved, RESO. 





[16] 


nTWI 


Not trap WFI. 


[2] Ifa WFI instruction executed at ELO would cause execution to be suspended, such as if there is not a 
pending WFI wakeup event, it is taken as an exception to EL1 using the 0x1 ESR code. 


1 WFI instructions are executed as normal. 


The reset value is @b1. 





[15:14] 


Reserved, RESO. 





[13] 


Vectors bit. This bit selects the base address of the exception vectors: 


7) Normal exception vectors, base address 0x@0000000. Software can remap this base address using 
the VBAR. 


1 High exception vectors, base address @xFFFFOQQ@Q. This base address is never remapped. 


The input VINITHI defines the reset value of the V bit. 





[12] 


Instruction cache enable. The possible values are: 


© Instruction (L1) and unified (L2) caches disabled for instruction fetch. This is the reset value. 


1 Instruction (L1) and unified (L2) caches enabled for instruction fetch. 





Reserved, RES1 





Reserved, RESO 





SED 


SETEND Disable: 


(2) The SETEND instruction is available. This is the reset value. 
1 The SETEND instruction is unallocated. 








[7] 





ITD 





Reserved, RESOIT Disable. Disables some uses of IT instructions at PL1 and PLO. 
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Table 4-210 SCTLR bit assignments (continued) 





Bits Name Function 





[6] - Reserved, RESO 





[5] CP15BEN | CP15 barrier enable. 


(2 CP15 barrier operations disabled. Their encodings are UNDEFINED. 


1 CP15 barrier operations enabled. 


The reset value is 0b1. 














[4:3] |- Reserved, RES1. 
[2] C Cache enable. This is a global enable bit for data and unified caches: 
(2 Data (L1) and unified (L2) caches disabled for data access. This is the reset value. 
1 Data (L1) and unified (L2) caches enabled for data access. 
[1] A Alignment check enable. This is the enable bit for Alignment fault checking: 
[3] Alignment fault checking disabled. This is the reset value. 
1 Alignment fault checking enabled. 
[0] M MMU enable. This is a global enable bit for the MMU stage 1 address translation: 
[2] EL1 and ELO stage 1 MMU disabled. This is the reset value. 
1 EL1 and ELO stage 1 MMU enabled. 














To access the SCTLR: 


MRC p15, ©, <Rt>, c1, c@, @ ; Read SCTLR into Rt 
MCR p15, ©, <Rt>, c1, c0, © ; Write Rt to SCTLR 


4.5.29 Auxiliary Control Register 
The ACTLR characteristics are: 








Purpose Controls write access to IMPLEMENTATION DEFINED registers in EL2, such as ECTLR, 
L2CTLR, and L2ZECTLR. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
|- |- [Rw [Rw RW | RW RW 








Configurations The processor does not implement the ACTLR (NS) register. This register is always 
RESO. It is mapped to AArch64 register ACTLR_EL1. See 4.3.38 Auxiliary Control 
Register, EL] on page 4-121. 


ACTLR (S) is mapped to AArch64 register ACTLR_EL3. See 4.3.40 Auxiliary 
Control Register, EL3 on page 4-123. 


Attributes ACTLR is a 32-bit register. 


The following figure shows the ACTLR bit assignments. 
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Figure 4-100 ACTLR bit assignments 


The following table shows the ACTLR bit assignments. 


Table 4-211 ACTLR bit assignments 





Bits |Name 


Function 





[31:6] | - 


Reserved, RESO. 





[5] L2ECTLR access control 


L2ECTLR write access control. The possible values are: 


© Theregister is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 





[4] L2CTLR access control 


L2CTLR write access control. The possible values are: 


© The register is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 





[3:2] l- 


Reserved, RESO. 





[1] ECTLR access control 


ECTLR write access control. The possible values are: 


© Theregister is not write accessible from a lower exception level. This is the reset value. 


1 The register is write accessible from EL2. 














Reserved, RESO. 








To access the ACTLR: 


MRC p15, @, 
MCR p15, @, 


<Rt>, c1, c@, 1 ; Read ACTLR into Rt 
<Rt>, c1, c0, 1 ; Write Rt to ACTLR 


4.5.30 Architectural Feature Access Control Register 
The CPACR characteristics are: 


Purpose 


Usage 
constraints 


Controls access to CPO to CP13, and indicates which of CPO to CP13 are 
implemented. 


This register is accessible as follows: 








ELO |ELO|EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |-  |Rw [Rw | RW [RW RW 


























The CPACR has no effect on instructions executed at EL2. 
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Configurations CPACR is architecturally mapped to AArch64 register CPACR_EL1. See 
4.3.41 Architectural Feature Access Control Register on page 4-124. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Bits in the NSACR control Non-secure access to the CPACR fields. See the field 
descriptions cp10 and cp11. 


Attributes CPACR is a 32-bit register. 


The following figure shows the CPACR bit assignments. 


31 30 24 23 22 21 2019 0 
qo ee ee 
L_ASEDIS 


Figure 4-101 CPACR bit assignments 
The following table shows the CPACR bit assignments. 


Table 4-212 CPACR bit assignments 





Bits Name _| Function 





[31] ASEDIS | Disable Advanced SIMD Functionality: 


© Does not cause any instructions to be UNDEFINED. This is the reset value. 


1 All instruction encodings that are part of Advanced SIMD, but that are not floating-point instructions, are 
UNDEFINED. 





[30:24] Reserved, RESO. 





[23:22] | cp11>"®° | Defines the access rights for CP11, that control the Advanced SIMD and floating-point features. Possible values of 
the fields are: 


@bee Access denied. Any attempt to access Advanced SIMD and floating-point registers or instructions 
generates an Undefined Instruction exception. This is the reset value. 


@b@1 Access at EL1 only. Any attempt to access Advanced SIMD and floating-point registers or instructions 
from software executing at ELO generates an Undefined Instruction exception. 


@b10 Reserved. 
@b11 Full access. 





[21:20] | cp10°° | Defines the access rights for CP10, that control the Advanced SIMD and floating-point features. Possible values of 
the fields are: 


@be@e Access denied. Any attempt to access Advanced SIMD and floating-point registers or instructions 
generates an Undefined Instruction exception. This is the reset value. 


@b@1 Access at EL1 only. Any attempt to access Advanced SIMD and floating-point registers or instructions 
from software executing at ELO generates an Undefined Instruction exception. 


@b10 Reserved. 
@b11 Full access. 





[19:0] Reserved, RESO. 

















bn The floating-point and Advanced SIMD features controlled by these fields are: 


Floating-point instructions. 
Advanced SIMD instructions, both integer and floating-point. 
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To access the CPACR: 


MRC p15,0,<Rt>,c1,c@,2 ; Read CPACR into Rt 
MCR p15,0,<Rt>,c1,c@,2 ; Write Rt to CPACR 


4.5.31 Secure Configuration Register 
The SCR characteristics are: 


Purpose Defines the configuration of the current security state. It specifies: 


¢ The security state of the processor, Secure or Non-secure. 
e What state the processor branches to, if an IRQ, FIQ or external abort occurs. 
+ Whether the CPSR.F and CPSR.A bits can be modified when SCR.NS = 1. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - - RW |- RW RW 


























Any read or write to SCR in Secure EL1 state in AArch32 is trapped as an exception 
to EL3. 


Configurations The SCR is a Restricted access register that exists only in the Secure state. 
The SCR is mapped to the AArch64 SCR_EL3 register. 
Attributes SCR is a 32-bit register. 


The following figure shows the SCR bit assignments. 


14131211109 8 76543 2 1 
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Figure 4-102 SCR bit assignments 


The following table shows the SCR bit assignments. 





Advanced SIMD and floating-point registers D0-D31 and their views as S0-S31 and QO-Q15. 
FPSCR, FPSID, MVFRO, MVFR1, MVFR2, FPEXC system registers. 
bo If the cp11 and cp10 fields are set to different values, the behavior is the same as if both fields were set to the value of cp10, in all respects other than the value read 
back by explicitly reading cp11. 
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Table 4-213 SCR bit assignments 





Bits Name | Function 





[31:14] Reserved, RESO. 





[13] TWE | Trap WFE instructions. The possible values are: 


© WFE instructions are not trapped. This is the reset value. 
1 WFE instructions executed in any mode other than Monitor mode are trapped to Monitor mode as UNDEFINED if 
the instruction would otherwise cause suspension of execution, that is if: 
¢ The event register is not set. 
¢ There is not a pending WFE wakeup event. 
¢ The instruction does not cause another exception. 





[12] TWI | Trap WFI instructions. The possible values are: 


@ WFI instructions are not trapped. This is the reset value. 


1 WFI instructions executed in any mode other than Monitor mode are trapped to Monitor mode as UNDEFINED if 
the instruction would otherwise cause suspension of execution. 





[11:10] Reserved, RESO. 





[9] SIF Secure Instruction Fetch. When the processor is in Secure state, this bit disables instruction fetches from Non-secure 
memory. The possible values are: 


© Secure state instruction fetches from Non-secure memory permitted. This is the reset value. 


1 Secure state instruction fetches from Non-secure memory not permitted. 





[8] HCE | Hyp Call enable. This bit enables use of the HVC instruction from Non-secure EL1 modes. The possible values are: 


© The HVC instruction is UNDEFINED in any mode. This is the reset value. 


1 The HVC instruction enabled in Non-secure EL1, and performs a Hyp Call. 





[7] SCD | Secure Monitor Call disable. Makes the SMC instruction UNDEFINED in Non-secure state. The possible values are: 


@ SMC executes normally in Non-secure state, performing a Secure Monitor Call. This is the reset value. 


1 The SMC instruction is UNDEFINED in Non-secure state. 


A trap of the SMC instruction to Hyp mode takes priority over the value of this bit. 





[6] nET | Not Early Termination. This bit disables early termination. 


This bit is not implemented, RESO. 





[5] AW A bit writable. This bit controls whether CPSR.A can be modified in Non-secure state. 
e CPSR.A can be modified only in Secure state. This is the reset value. 
e CPSR.A can be modified in any security state. 





[4] FW F bit writable. This bit controls whether CPSR.F can be modified in Non-secure state: 
e CPSR.F can be modified only in Secure state. This is the reset value. 
e CPSR.F can be modified in any security state. 





[3] EA External Abort handler. This bit controls which mode takes external aborts. The possible values are: 


(2) External aborts taken in abort mode. This is the reset value. 


1 External aborts taken in Monitor mode. 
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Table 4-213 SCR bit assignments (continued) 






























































Bits Name | Function 
[2] FIQ FIQ handler. This bit controls which mode takes FIQ exceptions. The possible values are: 
(2) FIQs taken in FIQ mode. This is the reset value. 
1 FIQs taken in Monitor mode. 
[1] IRQ |IRQ handler. This bit controls which mode takes IRQ exceptions. The possible values are: 
(2) IRQs taken in IRQ mode. This is the reset value. 
1 IRQs taken in Monitor mode. 
[0] NS Non-secure bit. Except when the processor is in Monitor mode, this bit determines the security state of the processor. 
The possible values are: 
(2) Processor is in Secure state. This is the reset value. 
1 Processor is in Non-secure state. 
To access the SCR: 
MRC p15,0,<Rt>,c1,c1,0 ; Read SCR into Rt 
MCR p15,0,<Rt>,c1,c1,0 ; Write Rt to SCR 
4.5.32 Secure Debug Enable Register 
The SDER characteristics are: 
Purpose Controls invasive and non-invasive debug in the Secure ELO state. 
Usage constraints This register is accessible as follows: 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
: 3. ks RW |- [RW RW 
Configurations SDER is architecturally mapped to AArch64 register SDER32_EL3. See 
4.3.50 Secure Debug Enable Register on page 4-142. 
This register is accessible only in Secure state. 
Attributes SDER is a 32-bit register. 
The following figure shows the SDER bit assignments. 
31 210 
em 
SUNIDEN = 
SUIDEN 
Figure 4-103 SDER bit assignments 
The following table shows the SDER bit assignments. 
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Table 4-214 SDER bit assignments 





Bits |Name Function 





(31:2] | - Reserved, RESO. 





[1] SUNIDEN | Secure User Non-invasive Debug Enable. The possible values are: 
@ Non-invasive debug not permitted in Secure ELO state. This is the Warm reset value. 


1 Non-invasive debug permitted in Secure ELO state. 





[0] SUIDEN | Secure User Invasive Debug Enable. The possible values are: 


© Invasive debug not permitted in Secure ELO state. This is the Warm reset value. 


1 Invasive debug permitted in Secure ELO state. 

















To access the SDER: 


MRC p15,0,<Rt>,c1,c1,1 ; Read SDER into Rt 
MCR p15,0,<Rt>,c1,c1,1 ; Write Rt to SDER 


4.5.33 Non-Secure Access Control Register 
The NSACR characteristics are: 








Purpose Defines the Non-secure access permission to CPO to CP13. 

Usage This register is accessible as follows: 

constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RW RW 


























Any read or write to NSACR in Secure EL1 state in AArch32 is trapped as an 
exception to EL3. 


Configurations There is one copy of this register that is used in both Secure and Non-secure states. 


If EL3 is using AArch64, then any reads of the NSACR from Non-secure EL2 or 
Non-secure EL1 using AArch32 return a fixed value of @xe@eeeCee. 


In AArch64, the NSACR functionality is replaced by the behavior in CPTR_EL3. 
Attributes NSACR is a 32-bit register. 


The following figure shows the NSACR bit assignments. 





31 161514 1211109 0 
NSASEDIS —! | | L_¢p10 
Reserved cp11 


Figure 4-104 NSACR bit assignments 
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The following table shows the NSACR bit assignments. 


Table 4-215 NSACR bit assignments 





Bits Name Function 





[31:16] | - Reserved, RESO. 





[15] NSASEDIS | Disable Non-secure Advanced SIMD functionality: 


© This bit has no effect on the ability to write CPACR.ASEDIS, this is the reset value. 


1 When executing in Non-secure state, the CPACR.ASEDIS bit has a fixed value of 1 and writes to it are 
ignored. 





[14:12] Reserved, RESO. 





[11] cpll Non-secure access to CP11 enable: 


@ Secure access only. Any attempt to access CP11 in Non-secure state results in an Undefined Instruction 
exception. If the processor is in Non-secure state, the corresponding bits in the CPACR ignore writes and 
read as @b@@, access denied. This is the reset value. 


1 Secure or Non-secure access. 





[10] cp10 Non-secure access to CP10 enable: 


© Secure access only. Any attempt to access CP10 in Non-secure state results in an Undefined Instruction 
exception. If the processor is in Non-secure state, the corresponding bits in the CPACR ignore writes and 
read as @b@@, access denied. This is the reset value. 


1 Secure or Non-secure access. 

















[9:0] Reserved, RESO. 





Note 


If the CP11 and CP10 fields are set to different values, the behavior is CONSTRAINED UNPREDICTABLE. It is 
the same as if both fields were set to the value of CP10, in all respects other than the value read back by 
explicitly reading CP11. 








To access the NSACR: 


MRC p15, ©, <Rt>, c1, c1, 2 ; Read NSACR into Rt 
MCR p15, ©, <Rt>, c1, c1, 2 ; Write Rt to NSACR 


4.5.34 Secure Debug Configuration Register 
The SDCR characteristics are: 
































Purpose Controls debug and performance monitors functionality in Secure state. 
Usage constraints This register is accessible as follows: 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - - RW |- RW RW 
Configurations SDCR is mapped to AArch64 register MDCR_EL3. 
Attributes SDCR is a 32-bit register. 


The following figure shows the SDCR bit assignments. 
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31 22 21 20 19 18 17 16 15 14 13 0 


EPMAD— L- SPD 
EDAD RESO 
SPME 


Figure 4-105 SDCR bit assignments 


The following table shows the SDCR bit assignments 


Table 4-216 SDCR bit assignments 





Bits 


Name 


Function 





[31:22] 


Reserved, RESO. 





[21] 


EPMAD 


Disables access to the performance monitor configuration registers by an external debugger: 


@ Access to Performance Monitors registers from external debugger is permitted. This is the reset value. 


1 Access to Performance Monitors registers from external debugger is disabled, unless overridden by 
authentication interface. 





[20] 


EDAD 


Disables access to the breakpoint and watchpoint registers by an external debugger: 


© Access to breakpoint and watchpoint registers from external debugger is permitted. This is the reset value. 


1 Access to breakpoint and watchpoint registers from external debugger is disabled, unless overridden by 
authentication interface. 





[19:18] 


Reserved, RESO. 





[17] 


SPME 


Secure performance monitors enable. This allows event counting in Secure state: 


@ Event counting prohibited in Secure state, unless overridden by the authentication interface. This is the reset 
value. 


1 Event counting allowed in Secure state. 





[16] 


Reserved, RESO. 





[15:14] 


SPD 


AArch32 secure privileged debug. Enables or disables debug exceptions in Secure state, other than Software 
breakpoint instructions. The possible values are: 


@bee@ Legacy mode. Debug exceptions from Secure EL1 are enabled by the authentication interface. 
@b1@ Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 

@b11 Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 

The value @b@1 is reserved. 

If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure ELO are also enabled. 
Otherwise, debug exceptions from Secure ELO are enabled only if SDER32_EL3.SUIDEN is 1. 


SPD is ignored in Non-secure state. Debug exceptions from Software breakpoint instruction debug events are 
always enabled. 


The reset value is @b@0. 








[13:0] 











Reserved, RESO. 





To access the SDCR: 


MRC p15,0,<Rt>,c1,c3,1 ; Read SDCR into Rt 
MCR p15,0,<Rt>,c1,c3,1 ; Write Rt to SDCR 
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4.5.35 Hyp Auxiliary Control Register 
The HACTLR characteristics are: 
Purpose Controls write access to IMPLEMENTATION DEFINED registers in Non-secure EL1 modes, 
such as ECTLR, L2CTLR, and LZECTLR. 
Usage constraints This register is accessible as follows: 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
P 2. a - |RW | RW = 
Configurations The HACTLR is architecturally mapped to the AArch4 ACTLR_EL2 register. See 
4.3.39 Auxiliary Control Register, EL2 on page 4-121. 
Attributes HACTLR is a 32-bit register. 
The following figure shows the HACTLR bit assignments. 
31 6543210 
L2ECTLR access control | 
L2CTLR access control 
ECTLR access control 
RESO 
Figure 4-106 HACTLR bit assignments 
The following table shows the HACTLR bit assignments. 
Table 4-217 HACTLR bit assignments 
Bits | Name Function 
[31:6] | - Reserved, RESO. 
[5] L2ECTLR access L2ECTLR write access control. The possible values are: 
gua © The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR(S)[5] to be set. 
[4] L2CTLR access L2CTLR write access control. The possible values are: 
control © The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 
Write access from Non-secure EL1 also requires ACTLR(S)[4] to be set. 
[3:2] |- Reserved, RESO. 
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Table 4-217 HACTLR bit assignments (continued) 








Bits | Name Function 
[1] ECTLR access ECTLR write access control. The possible values are: 
control 


© The register is not write accessible from Non-secure EL1. 
This is the reset value. 
1 The register is write accessible from Non-secure EL1. 


Write access from Non-secure EL1 also requires ACTLR(S)[1] to be set. 

















[0] Reserved, RESO. 





To access the HACTLR: 


MRC p15,4,<Rt>,c1,c@,1 ; Read HACTLR into Rt 
MCR p15,4,<Rt>,c1,c@,1 ; Write Rt to HACTLR 


4.5.36 Hyp System Control Register 
The HSCTLR characteristics are: 


Purpose Provides top level control of the system operation in Hyp mode. This register 
provides Hyp mode control of features controlled by the Banked SCTLR bits, and 
shows the values of the non-Banked SCTLR bits. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 


























a = | - |RW]RW = 





Configurations HSCTLR is architecturally mapped to AArch64 register SCTLR_EL2. See 
4.3.42 System Control Register, EL2 on page 4-125. 


Attributes HSCTLR is a 32-bit register. 


The following figure shows the HSCTLR bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 1211109 876543210 





L— RESO RESO—! REs0— LREs1 resit SED- 
WXN RESO ITD 
RES1 RESO 


CP15BEN 


Figure 4-107 HSCTLR bit assignments 
The following table shows the HSCTLR bit assignments. 
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Table 4-218 HSCTLR bit assignments 










































































Bits |Name Function 
[31] - Reserved, RESO. 
[30] TE Thumb Exception enable. This bit controls whether exceptions taken in Hyp mode are taken in A32 or T32 state: 
2) Exceptions taken in A32 state. 
1 Exceptions taken in T32 state. 
[29:28] | - Reserved, RES1. 
[27:26] | - Reserved, RESO. 
[25] EE Exception Endianness. The value of this bit defines the value of the CPSR.E bit on entry to an exception vector, 
including reset. This value also indicates the endianness of the translation table data for translation table lookups: 
2) Little endian. 
1 Big endian. 
The reset value is UNKNOWN. 
[24] - Reserved, RESO. 
[23:22] | - Reserved, RES1. 
[21] FI Fast Interrupts configuration enable bit. This bit can be used to reduce interrupt latency by disabling 
implementation-defined performance features. 
This bit is not implemented, RESO. 
[20] - Reserved, RESO. 
[19] WXN Write permission implies Execute Never (XN). This bit can be used to require all memory regions with write 
permission to be treated as XN: 
7) Regions with write permission are not forced to XN. 
1 Regions with write permission are forced to XN. 
The WXN bit is permitted to be cached in a TLB. The reset value is UNKNOWN. 
[18] - Reserved, RES1. 
[17] - Reserved, RESO. 
[16] - Reserved, RES1. 
[15:13] | - Reserved, RESO. 
[12] I Instruction cache enable. This is an enable bit for instruction caches at EL2: 
(2 Instruction caches disabled at EL2. If HSCTLR.M is set to 0, instruction accesses from stage 1 of the 
EL2 translation regime are to Normal memory, Outer Shareable, Inner Non-cacheable, Outer Non- 
cacheable. 
1 Instruction caches enabled at EL2. If HSCTLR.M is set to 0, instruction accesses from stage 1 of the 
EL2 translation regime are to Normal memory, Outer Shareable, Inner Write-Through, Outer Write- 
Through. 
When this bit is 0, all EL2 Normal memory instruction accesses are Non-cacheable. 
[11] - Reserved, RES1. 
[10:9] |- Reserved, RESO. 
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Table 4-218 HSCTLR bit assignments (continued) 





Bits 


Name 


Function 





[8] 


SED 


SETEND Disable: 


(2) The SETEND instruction is available. 
1 The SETEND instruction is unallocated. 


The reset value is UNKNOWN. 





[7] 


ITD 


Reserved, RESO. 


IT Disable. Disables some uses of IT instructions at PL1 and PLO. 





[6] 


Reserved, RESO. 





[5] 


CP15BEN 


CP15 barrier enable: 


7) CP 15 barrier operations disabled. Their encodings are UNDEFINED. 


1 CP 15 barrier operations enabled. 


The reset value is UNKNOWN. 





[4:3] 


Reserved, RES1. 





[2] 


Cache enable. This is an enable bit for data and unified caches at EL2: 


(2) Data and unified caches disabled at EL2. 
1 Data and unified caches enabled at EL2. 


When this bit is 0, all EL2 Normal memory data accesses and all accesses to the EL2 translation tables are Non- 
cacheable. 


Resets to UNKNOWN. 





[1] 


Alignment check enable. This is the enable bit for Alignment fault checking: 


7) Alignment fault checking disabled. 
1 Alignment fault checking enabled. 


When this bit is 1, all instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, have an alignment check that the address being accessed is aligned to the size of the 
data element(s) being accessed. If this check fails it causes an Alignment fault, that is taken as a Data Abort 
exception. 


Load/store exclusive and load-acquire/store-release instructions have this alignment check regardless of the value 
of the A bit. 


Resets to UNKNOWN. 











MMU enable. This is a global enable bit for the EL2 stage 1 MMU: 


7) EL2 stage 1 MMU disabled. 
1 EL2 stage 1 MMU enabled. 


Resets to UNKNOWN. 








To access the HSCTLR: 


MRC p15,4,<Rt>,c1,c@,@ ; Read HSCTLR into Rt 
MCR p15,4,<Rt>,c1,c0,@ ; Write Rt to HSCTLR 
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4.5.37 Hyp Configuration Register 
The HCR characteristics are: 
Purpose Provides configuration controls for virtualization, including defining whether 
various Non-secure operations are trapped to Hyp mode. 
Usage constraints This register is accessible as follows: 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
p a. a - |RW | RW : 
Configurations HCR is architecturally mapped to AArch64 register HCR_EL2[31:0]. See 
4.3.43 Hypervisor Configuration Register on page 4-127. 
Attributes HCR is a 32-bit register. 
The following figure shows the HCR bit assignments. 
31 30 29 28 27 26 25 24 23 22 21 20191817 16 15 14 13 12 1110 9 876543210 
RESO al L VM 
TRVM SWIO 
HCD PTW 
RESO FMO 
TGE IMO 
TVM AMO 
TTLB VF 
TPU Vi 
TPC VA 
TSW FB 
TAC BSU 
TIDCP DC 
TSC TWI 
TID3 TWE 
TID2 TIDO 
TID1 
Figure 4-108 HCR bit assignments 
The following table shows the HCR bit assignments. 
Table 4-219 HCR bit assignments 
Bits |Name | Function 
[31] - Reserved, RESO. 
[30] TRVM | Trap Read of Virtual Memory controls. 


the following registers: 


The reset value is 0. 











When 1, this causes Reads to the EL1 virtual memory control registers from EL1 to be trapped to EL2. This covers 


SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR/MAIRO, NMRR/ 
MAIRI, AMAIRO, AMAIR1, and CONTEXTIDR. 
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Table 4-219 HCR bit assignments (continued) 





Bits 


Name 


Function 





[29] 


HCD 


Hyp Call Disable. The HCD value is: 
e HVC is enabled at EL1 or EL2. 


1 HVC is UNDEFINED at all exception levels. 


The reset value is 0. 





[28] 


Reserved, RESO. 





[27] 


TGE 


Trap General Exceptions. If this bit is set, and SCR_EL3.NS is set, then: 

All exceptions that would be routed to EL1 are routed to EL2. 

e The SCTLR.M bit is treated as 0 regardless of its actual state, other than for the purpose of reading the bit. 

* The HCR.FMO, IMO, and AMO bits are treated as 1 regardless of their actual state, other than for the purpose 
of reading the bits. 

¢ All virtual interrupts are disabled. 

« Any implementation defined mechanisms for signaling virtual interrupts are disabled. 

e An exception return to EL] is treated as an illegal exception return. 


Additionally, if HCR.TGE is 1, the HDCR.{TDRA,TDOSA,TDA} bits are ignored and the processor behaves as if 
they are set to 1, other than for the value read back from HDCR. 


The reset value is 0. 





[26] 


TVM 


Trap Virtual Memory controls. When 1, this causes Writes to the EL1 virtual memory control registers from EL1 to 
be trapped to EL2. This covers the following registers: 


SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR/MAIRO, NMRR/ 
MAIRI, AMAIRO, AMAIR1, and CONTEXTIDR. 


The reset value is 0. 





[25] 


TTLB 


Trap TLB maintenance instructions. When 1, this causes TLB maintenance instructions executed from EL] that are 
not UNDEFINED to be trapped to EL2. This covers the following instructions: 


TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, 
TLBIMVALIS, TLBIMVAALIS, TLBIMVAL, and TLBIMVAAL. 


The reset value is 0. 





[24] 


TPU 


Trap Cache maintenance instructions to Point of Unification. When 1, this causes Cache maintenance instructions to 
the point of unification executed from EL1 or ELO that are not UNDEFINED to be trapped to EL2. This covers the 
following instructions: 


ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU. 


The reset value is 0. 





[23] 








TPC 





Trap Data/Unified Cache maintenance operations to Point of Coherency. When 1, this causes Data or Unified Cache 
maintenance instructions by address to the point of coherency executed from EL1 or ELO that are not UNDEFINED to 
be trapped to EL2. This covers the following instructions: 


DCIMVAC, DCCIMVAC, and DCCMVAC. 


The reset value is 0. 
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Table 4-219 HCR bit assignments (continued) 


















































Bits Name | Function 

[22] TSW | Trap Data/Unified Cache maintenance operations by Set/Way. When 1, this causes Data or Unified Cache 
maintenance instructions by set/way executed from EL1 that are not UNDEFINED to be trapped to EL2. This covers 
the following instructions: 
DCISW, DCCSW, and DCCISW. 
The reset value is 0. 

[21] TAC | Trap ACTLR accesses. When this bit is set to 1, any valid Non-secure access to the ACTLR is trapped to Hyp mode. 
The reset value is 0. 

[20] TIDCP | Trap Implementation Dependent functionality. When 1, this causes accesses to all CP15 MCR and MRC instructions 
executed from EL1, to be trapped to EL2 as follows: 
e CRnis 9, Opcodel is 0 to 7, CRm is c0, cl, c2, c5, c6, c7, c8, opcode? is 0 to 7. 
e CRnis 10, Opcodel is 0 to 7, CRm is c0, c1, c4, c8, opcode? is 0 to 7. 
e CRnis 11, Opcodel is 0 to 7, CRm is c0 to c8, or c15, opcode? is 0 to 7. 
Accesses from ELO are UNDEFINED. 
Resets to 0. 

[19] TSC Trap SMC instruction. When this bit is set to 1, any attempt from a Non-secure EL1 state to execute an SMC 
instruction, that passes its condition check if it is conditional, is trapped to Hyp mode. 
The reset value is 0. 

[18] TID3 | Trap ID Group 3. When 1, this causes reads to the following registers executed from EL1 to be trapped to EL2: 
ID_PFRO, ID_PFR1, ID_DFRO, ID_AFRO, ID_ MMFRO, ID MMFR1, ID_MMFR2, ID MMFR3, ID_ISARO, 
ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, ID ISAR5, MVFRO, MVFR1, and MVFR2. Also MRC instructions 
to any of the following encodings: 
e CP15, OPCI is 0, CRn is 0, CRm is c3, c4, c5, c6, or c7, and Opc2 is 0 or 1. 
e CP15, Opcl is 0, CRn is 0, CRm is c3, and Opc2 is 2. 
e CP15, Opcl is 0, CRn is 0, CRm is 5, and Opc2 is 4 or 5. 
The reset value is 0. 

[17] TID2 | Trap ID Group 2. When 1, this causes reads (or writes to CSSELR) to the following registers executed from EL1 or 
ELO if not UNDEFINED to be trapped to EL2: 
CTR, CCSIDR, CLIDR, and CSSELR. 
The reset value is 0. 

[16] TID1 | Trap ID Group 1. When 1, this causes reads to the following registers executed from EL1 to be trapped to EL2: 
TCMTR, TLBTR, AIDR, and REVIDR. 
The reset value is 0. 

[15] TIDO |Trap ID Group 0. When 1, this causes reads to the following registers executed from EL1 or ELO if not UNDEFINED 
to be trapped to EL2: 
FPSID and JIDR. 
The reset value is 0. 

[14] TWE |Trap WFE. When 1, this causes the WFE instruction executed from EL1 or ELO to be trapped to EL2 if the 
instruction would otherwise cause suspension of execution. For example, if the event register is not set: 
The reset value is 0. 

ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-264 


reserved. 
Non-Confidential 


4 System Control 
4.5 AArch32 register descriptions 


Table 4-219 HCR bit assignments (continued) 





Bits Name | Function 





[13] TWI | Trap WFI. When 1, this causes the WFI instruction executed from EL1 or ELO to be trapped to EL2 if the instruction 
would otherwise cause suspension of execution. For example, if there is not a pending WFI wake-up event: 


The reset value is 0. 





[12] DC Default cacheable. When this bit is set to 1, and the Non-secure EL1 and ELO stage 1 MMU is disabled, the memory 
type and attributes determined by the stage 1 translation is Normal, Non-shareable, Inner Write-Back Write- 
Allocate, Outer Write-Back Write-Allocate. 


The reset value is 0. 





[11:10] | BSU | Barrier Shareability upgrade. The value in this field determines the minimum shareability domain that is applied to 
any barrier executed from EL1 or ELO. The possible values are: 


@bee No effect. 

@be1 Inner Shareable. 
@b10 Outer Shareable. 
@b1i1 Full System. 


The reset value is 0. 





[9] FB Force Broadcast. When 1, this causes the following instructions to be broadcast within the Inner Shareable domain 
when executed from Non-secure EL1: 


TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, BPIALL, and ICIALLU. 


The reset value is 0. 





[8] VA Virtual Asynchronous Abort exception. When the AMO bit is set to 1, setting this bit signals a virtual Asynchronous 
Abort exception to the Guest OS, when the processor is executing in Non-secure state at ELO or EL1. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


The reset value is 0. 





[7] VI Virtual IRQ exception. When the IMO bit is set to 1, setting this bit signals a virtual IRQ exception to the Guest OS, 
when the processor is executing in Non-secure state at ELO or EL1. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


The reset value is 0. 





[6] VF Virtual FIQ exception. When the FMO bit is set to 1, setting this bit signals a virtual FIQ exception to the Guest OS, 
when the processor is executing in Non-secure state at ELO or EL1. 


The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


The reset value is 0. 





[5] AMO | Asynchronous Abort Mask Override. When this is set to 1, it overrides the effect of CPSR.A, and enables virtual 
exception signaling by the VA bit. 


The reset value is 0. 





[4] IMO _ | IRQ Mask Override. When this is set to 1, it overrides the effect of CPSR.I, and enables virtual exception signaling 
by the VI bit. 


The reset value is 0. 
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Table 4-219 HCR bit assignments (continued) 





Bits Name | Function 





[3] FMO | FIQ Mask Override. When this is set to 1, it overrides the effect of CPSR.F, and enables virtual exception signaling 
by the VF bit. 


The reset value is 0. 





[2] PTW | Protected Table Walk. When 1, if the stage 2 translation of a translation table access made as part of a stage 1 
translation table walk at ELO or EL1 maps that translation table access to Device memory, the access is faulted as a 
stage 2 Permission fault. 


The reset value is 0. 





[1] SWIO | Set/Way Invalidation Override. When 1, this causes EL1 execution of the data cache invalidate by set/way 
instruction to be treated as data cache clean and invalidate by set/way. DCISW is executed as DCCISW. 


This bit is RES1. 





[0] VM Second stage of Translation enable. When 1, this enables the second stage of translation for execution in EL1 and 
ELO. 


The reset value is 0. 

















To access the HCR: 


MRC p15, 4, <Rt>, c1, c1, @; Read Hyp Configuration Register 
MCR p15, 4, <Rt>, c1, c1, @; Write Hyp Configuration Register 


4.5.38 Hyp Configuration Register 2 
The HCR2 characteristics are: 


Purpose Provides additional configuration controls for virtualization. 
Usage constraints This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
ee ie lhe (ee ae ee z 


























Configurations HCR2 is architecturally mapped to AArch64 register HCR_EL2[63:32]. 
This register is accessible only at EL2 or EL3. 
Attributes HCR2 is a 32-bit register. 


The following figure shows the HCR2 bit assignments. 


31 210 


mm 
È CD 
ID 
Figure 4-109 HCR2 bit assignments 


The following table shows the HCR2 bit assignments. 
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Table 4-220 HCR2 bit assignments 





Bits | Name | Function 





[31:2] | - Reserved, RESO. 





[1] ID Stage 2 Instruction cache disable. When HCR.VM is 1, this forces all stage 2 translations for instruction accesses to 
Normal memory to be Non-cacheable for the EL1/ELO translation regime. The possible values are: 


© No effect on the stage 2 of the EL1/EL0 translation regime for instruction accesses. 


1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable for the ELO/EL1 
translation regime. 


The reset value is 0. 





[0] CD Stage 2 Data cache disable. When HCR.VM is 1, this forces all stage 2 translations for data accesses and translation 
table walks to Normal memory to be Non-cacheable for the EL1/ELO translation regime. The possible values are: 


© No effect on the stage 2 of the EL1/EL0 translation regime for data accesses and translation table walks. 


1 Forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non- 
cacheable for the ELO/EL1 translation regime. 


The reset value is 0. 

















To access the HCR2: 


MRC p15,4,<Rt>,c1,c1,4 ; Read HCR2 into Rt 
MCR p15,4,<Rt>,c1,c1,4 ; Write Rt to HCR2 


4.5.39 Hyp Debug Control Register 
The HDCR characteristics are: 








Purpose Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to 
functions provided by the debug and trace architectures and the Performance 
Monitor. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
A s is - |RW | RW a 


























Configurations • HDCR is architecturally mapped to AArch64 register MDCR_EL2. See 
4.3.44 Hyp Debug Control Register on page 4-132. 
e This register is accessible only at EL2 or EL3. 


Attributes HDCR is a 32-bit register. 


The following figure shows the HDCR bit assignments. 
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Figure 4-110 HDCR bit assignments 
The following table shows the HDCR bit assignments. 


Table 4-221 HDCR bit assignments 





Bits 


Name 


Function 





[31:12] 


Reserved, RESO. 





[11] 


TDRA 


Trap debug ROM address register access. 
© Has no effect on accesses to debug ROM address registers from EL1 and ELO. 
1 Trap valid Non-secure EL1 and ELO access to debug ROM address registers to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the following registers is trapped to Hyp mode: 


e DBGDRAR. 
* DBGDSAR. 


If HCR.TGE is 1 or HDCR.TDE is 1, then this bit is ignored and treated as though it is 1 other than for the value 
read back from HDCR. 


On Warm reset, the field resets to 0. 





[10] 








TDOSA 





Trap Debug OS-related register access: 


© Has no effect on accesses to CP14 Debug registers. 


1 Trap valid Non-secure accesses to CP14 OS-related Debug registers to Hyp mode. 


When this bit is set to 1, any valid Non-secure CP14 access to the following OS-related Debug registers is trapped 
to Hyp mode: 

* DBGOSLSR. 

e DBGOSLAR. 

e DBGOSDLR. 

« DBGPRCR. 


If HCR.TGE is 1 or HDCR.TDE is 1, then this bit is ignored and treated as though it is 1 other than for the value 
read back from HDCR. 


On Warm reset, the field resets to 0. 
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Table 4-221 HDCR bit assignments (continued) 





Bits 


Name 


Function 





TDA 


Trap Debug Access: 


© Has no effect on accesses to CP14 Debug registers. 


1 Trap valid Non-secure accesses to CP14 Debug registers to Hyp mode. 


When this bit is set to 1, any valid access to the CP14 Debug registers, other than the registers trapped by the 
TDRA and TDOSA bits, is trapped to Hyp mode. 


If HCR.TGE is 1 or HDCR.TDE is1, then this bit is ignored and treated as though it is 1 other than for the value 
read back from HDCR. 


On Warm reset, the field resets to 0. 





[8] 


TDE 


Trap Debug Exceptions: 

(2) Has no effect on Debug exceptions. 

1 Route Non-secure Debug exceptions to Hyp mode. 

When this bit is set to 1, any Debug exception taken in Non-secure state is trapped to Hyp mode. 


If HCR.TGE is 1, then this bit is ignored and treated as though itis 1 other than for the value read back from 
HDCR. This bit resets to 0. 





[7] 


HPME 


Hypervisor Performance Monitor Enable: 


e Hyp mode performance monitor counters disabled. 


1 Hyp mode performance monitor counters enabled. 


When this bit is set to 1, access to the performance monitors that are reserved for use from Hyp mode is enabled. 
For more information, see the description of the HPMN field. 


The reset value is 0. 





[6] 








TPM 





Trap Performance Monitor accesses: 
@ Has no effect on performance monitor accesses. 


1 ‘Trap valid Non-secure performance monitor accesses to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the Performance Monitor registers is trapped to Hyp mode. 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 


The reset value is 0. 
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Table 4-221 HDCR bit assignments (continued) 





Bits Name_| Function 





[5] TPMCR | Trap Performance Monitor Control Register accesses: 
© Has no effect on PMCR accesses. 


1 Trap valid Non-secure PMCR accesses to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the PMCR is trapped to Hyp mode. See the ARM” 
Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 


The reset value is 0. 





[4:0] HPMN | Hyp Performance Monitor count. Defines the number of Performance Monitors counters that are accessible from 
Non-secure EL1 and ELO modes if unprivileged access is enabled. 


In Non-secure state, HPMN divides the Performance Monitors counters as follows: 
If PMnEVCNTR is performance monitor counter n then, in Non-secure state: 


e Ifnis inthe range 0 <n <HPMN, the counter is accessible from EL1 and EL2, and from ELO if unprivileged 
access to the counters is enabled. 

e Ifnis in the range HPMN < n <PMCRN, the counter is accessible only from EL2. The HPME bit enables 
access to the counters in this range. 


If this field is set to 0, or to a value larger than PMCR.N, then the behavior in Non-secure ELO and EL] is 
CONSTRAINED UNPREDICTABLE, and one of the following must happen: 


e The number of counters accessible is an UNKNOWN non-zero value less than PMCR.N. 
e There is no access to any counters. 


For reads of HDCR.HPMN by EL2 or higher, if this field is set to 0 or to a value larger than PMCR.N, the 

processor must return a CONSTRAINED UNPREDICTABLE value being one of: 

e PMCR.N. 

¢ The value that was written to HDCR.HPMN. 

e (The value that was written to HDCR.HPMN) modulo 2h, where h is the smallest number of bits required for a 
value in the range 0 to PMCR.N. 


This field resets to 0x6. 

















To access the HDCR: 


MRC p15,4,<Rt>,c1,c1,1 ; Read HDCR into Rt 
MCR p15,4,<Rt>,c1,c1,1 ; Write Rt to HDCR 


4.5.40 Hyp Architectural Feature Trap Register 
The HCPTR characteristics are: 


Purpose Controls trapping to Hyp mode of Non-secure access, at EL1 or lower, to 
coprocessors other than CP14 and CP15 and to floating-point and Advanced SIMD 
functionality. Also controls access from Hyp mode to this functionality. 
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Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





: s7 le -  |RW IRW 2 


























If a bit in the NSACR prohibits a Non-secure access, then the corresponding bit in 
the HCPTR behaves as RAO/WI for Non-secure accesses. See the bit description for 


TASE. 
Configurations HCPTR is architecturally mapped to AArch64 register CPTR_EL2. 
Attributes HCPTR is a 32-bit register. 


The following figure shows the HCPTR bit assignments. 


31 30 161514131211109 876543210 


fi RESO a RES1 fl) RES1 


L_TCPAC TASE — L_TCP10 
RESO TCP11 


Figure 4-111 HCPTR bit assignments 
The following table shows the HCPTR bit assignments. 


Table 4-222 HCPTR bit assignments 





Bits Name Function 





[31] TCPAC |Trap CPACR accesses. The possible values of this bit are: 

© Has no effect on CPACR accesses. 

1 Trap valid Non-secure EL1 CPACR accesses to Hyp mode. 

When this bit is set to 1, any valid Non-secure EL1 access to the CPACR is trapped to Hyp mode. 


Resets to 0. 





[30:16] Reserved, RESO. 





[15] TASE Trap Advanced SIMD use: 


@ Ifthe NSACR settings permit Non-secure use of the Advanced SIMD functionality then Hyp mode can access 
that functionality, regardless of any settings in the CPACR. This bit value has no effect on possible use of the 
Advanced SIMD functionality from Non-secure EL1 and ELO modes. 


1 Trap valid Non-secure accesses to Advanced SIMD functionality to Hyp mode. 


If NSACR.NSASEDIS is set to 1, then on Non-secure accesses to the HCPTR, the TASE bit behaves as RAO/WI. 


Resets to 0. 





[14] Reserved, RESO. 








[13:12] Reserved, RES1. 
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Table 4-222 HCPTR bit assignments (continued) 





Bits Name Function 





[11] TCP11°? | Trap CP11. The possible values are: 
© IfNSACR.cp11 is set to 1, then Hyp mode can access CP11, regardless of the value of CPACR.cp11. This bit 
value has no effect on possible use of CP11 from Non-secure EL1 and ELO modes. 


1 Trap valid Non-secure accesses to CP11 to Hyp mode. 
Any otherwise-valid access to CP11 from: 


e A Non-secure EL1 or ELO state is trapped to Hyp mode. 
¢ Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 


Resets to 0. 





[10] TCP10°? | Trap CP10. The possible values are: 
@ IfNSACR.cp10 is set to 1, then Hyp mode can access CP10, regardless of the value of CPACR.cp10. This bit 
value has no effect on possible use of CP10 from Non-secure EL1 and ELO modes. 


1 Trap valid Non-secure accesses to CP10 to Hyp mode. 
Any otherwise-valid access to CP10 from: 


e ANon-secure EL1 or ELO state is trapped to Hyp mode. 
e Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 


Resets to 0. 

















[9:0] - Reserved, RES1. 





To access the HCPTR: 


MRC p15,4,<Rt>,c1,c1,2 ; Read HCPTR into Rt 
MCR p15,4,<Rt>,c1,c1,2 ; Write Rt to HCPTR 


4.5.41 Translation Table Base Register 0 
The TTBRO characteristics are: 


Purpose Holds the base address of translation table 0, and information about the memory it 
occupies. This is one of the translation tables for the stage | translation of memory 
accesses from modes other than Hyp mode. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - RW |RW |RW | RW RW 


























Used in conjunction with the TTBCR. When the 64-bit TTBRO format is used, 
cacheability and shareability information is held in the TTBCR and not in TTBRO. 





bp If the TCP11 and TCP10 fields are set to different values, the behavior is the same as if both fields were set to the value of TCP10 in all respects other than the value 
read back by explicitly reading TCP11. 
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Configurations TTBRO (NS) is architecturally mapped to AArch64 register TTBRO_EL1. See 
4.3.51 Translation Table Base Register 0, ELI on page 4-142. 


TTBRO (S) is mapped to AArch64 register TTBRO_EL3. See 4.3.59 Translation 
Table Base Register 0, EL3 on page 4-155. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


Attributes TTBRO is: 


e A 32-bit register when TTBCR.EAE is 0. 
e A 64-bit register when TTBCR.EAE is 1. 


There are different formats for this register. TTBCR.EAE determines which format of the register is 
used. This section describes: 

¢ TTBRO format when using the Short-descriptor translation table format on page 4-273. 

e TTBRO format when using the Long-descriptor translation table format on page 4-274. 


TTBRO format when using the Short-descriptor translation table format 
The following figure shows the TTBRO bit assignments when TTBCR.EAE is 0. 


IRGN[0] a| 
NOS 
RESO 


s 
IRGN[1] 





Figure 4-112 TTBRO bit assignments, TTBCR.EAE is 0 
The following table shows the TTBRO bit assignments when TTBCR.EAE is 0. 


Table 4-223 TTBRO bit assignments, TTBCR.EAE is 0 





Bits 


Name 


Function 





[31:7] 


TTBO 


Translation table base 0 address, bits[31:x], where x is 14-(TTBCR.N). Bits [x-1:7] are RESO. 
The value of x determines the required alignment of the translation table, that must be aligned to 2* bytes. 


If bits [x-1:7] are not all zero, this is a misaligned Translation Table Base Address. Its effects are CONSTRAINED 
UNPREDICTABLE, where bits [x-1:7] are treated as if all the bits are zero. The value read back from those bits is the 
value written. 





IRGN[0] 


See bit[0] for a description of the IRGN field. 











NOS 





Not Outer Shareable bit. Indicates the Outer Shareable attribute for the memory associated with a translation table 
walk that has the Shareable attribute, indicated by TTBRO.S is 1. The possible values are: 


(2) Outer Shareable. 


1 Inner Shareable. 


This bit is ignored when TTBRO:S is 0. 
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Table 4-223 TTBRO bit assignments, TTBCR.EAE is 0 (continued) 





Bits |Name Function 





[4:3] | RGN Region bits. Indicates the Outer cacheability attributes for the memory associated with the translation table walks. 
The possible values are: 

@bee Normal memory, Outer Non-cacheable. 

Q@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 

@b10 Normal memory, Outer Write-Through Cacheable. 

Q@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 








[2] - Reserved, RESO. 

[1] S Shareable bit. Indicates the Shareable attribute for the memory associated with the translation table walks. The 
possible values are: 
(2 Non-shareable. 
1 Shareable. 





[0] IRGN[1] | Inner region bits. Indicates the Inner Cacheability attributes for the memory associated with the translation table 
walks. The possible values of IRGN[1:0] are: 

e@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

@b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 

















To access the TTBRO when TTBCR.EAE is 0: 


MRC p15,0,<Rt>,c2,c@,@ ; Read TTBR@ into Rt 
MCR p15,0,<Rt>,c2,c0,@ ; Write Rt to TTBRO 


TTBRO format when using the Long-descriptor translation table format 
The following figure shows the TTBRO bit assignments when TTBCR.EAE is 1. 


56 55 48 47 0 


63 
RESO | ASID | BADDR[47:x] 


Figure 4-113 TTBRO bit assignments, TTBCR.EAE is 1 
The following table shows the TTBRO bit assignments when TTBCR.EAE is 1. 
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Table 4-224 TTBRO bit assignments, TTBCR.EAE is 1 





























Bits |Name Function 
[63:56] | - Reserved, RESO. 
[55:48] | ASID An ASID for the translation table base address. The TTBCR.A1 field selects either TTBRO.ASID or 
TTBR1.ASID. 
[47:0] | BADDR[47:x] | Translation table base address, bits[47:x]. Bits [x-1:0] are RESO. 
x is based on the value of TTBCR.TOSZ, and is calculated as follows: 
¢ IfTTBCR.TOSZ is 0 or 1, x = 5 - TTBCR.TOSZ. 
e IfTTBCR.TOSZ is greater than 1, x = 14- TTBCR.TOSZ. 
The value of x determines the required alignment of the translation table, that must be aligned to 2x bytes. 
If bits [x-1:3] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:0] are treated as if all the bits are zero. The value read back 
from those bits is the value written. 
To access the TTBRO when TTBCR.EAE==1: 
MRRC p15,0,<Rt>,<Rt2>,c2 ; Read 64-bit TTBR@ into Rt (low word) and Rt2 (high word) 
MCRR p15,0,<Rt>,<Rt2>,c2 ; Write Rt (low word) and Rt2 (high word) to 64-bit TTBR® 
4.5.42 Translation Table Base Register 1 


The TTBR1 characteristics are: 


Purpose Holds the base address of translation table 1, and information about the memory it 


occupies. This is one of the translation tables for the stage 1 translation of memory 
accesses from modes other than Hyp mode. 








Usage This register is accessible as follows: 

constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW IRW |RW | RW RW 


























Used in conjunction with the TTBCR. When the 64-bit TTBR1 format is used, 
cacheability and shareability information is held in the TTBCR and not in TTBR1. 
See 4.5.43 Translation Table Base Control Register on page 4-277. 


Configurations TTBR1 (NS) is architecturally mapped to AArch64 register TTBRO_EL1. See 


4.3.52 Translation Table Base Register I on page 4-143. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


Attributes TTBR1 is: 


There 


e A 32-bit register when TTBCR.EAE is 0. 
e A 64-bit register when TTBCR.EAE is 1. 


are two formats for this register. TTBCR.EAE determines which format of the register is used. 


This section describes: 


e TTBRI1 format when using the Short-descriptor translation table format on page 4-275. 
e TTBRI format when using the Long-descriptor translation table format on page 4-277. 


TTBR1 format when using the Short-descriptor translation table format 
The following figure shows the TTBR1 bit assignments when TTBCR.EAE is 0. 
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31 76543 2 1 


IRGN[0] — RESO | 
NOS ll 
IRGN[1] 


Figure 4-114 TTBR1 bit assignments, TTBCR.EAE is 0 
The following table shows the TTBR1 bit assignments when TTBCR.EAE is 0. 


Table 4-225 TTBR1 bit assignments, TTBCR.EAE is 0 





Bits 


Name 


Function 





[31:7] 


TTB1 


Translation table base 1 address, bits[31:x], where x is 14-(TTBCR.N). Bits [x-1:7] are RESO. 
The translation table must be aligned on a 16KByte boundary. 


If bits [x-1:7] are not all zero, this is a misaligned Translation Table Base Address. Its effects are CONSTRAINED 
UNPREDICTABLE, where bits [x-1:7] are treated as if all the bits are zero. The value read back from those bits is the 
value written. 





IRGN[O] 


See bit[0] for description of the IRGN field. 





[5] 


NOS 


Not Outer Shareable bit. Indicates the Outer Shareable attribute for the memory associated with a translation table 
walk that has the Shareable attribute, indicated by TTBRO.S is 1. The possible values are: 


(7) Outer Shareable. 


1 Inner Shareable. 


This bit is ignored when TTBRO:S is 0. 





[4:3] 


RGN 


Region bits. Indicates the Outer cacheability attributes for the memory associated with the translation table walks. 
The possible values are: 

@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 

@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





Reserved, RESO. 





[1] 


Shareable bit. Indicates the Shareable attribute for the memory associated with the translation table walks. The 
possible values are: 


(2) Non-shareable. 
1 Shareable. 





[0] 








IRGN[1] 





Inner region bits. Indicates the Inner Cacheability attributes for the memory associated with the translation table 
walks. The possible values of IRGN[1:0] are: 


@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 








To access the TTBR1 when TTBCR.EAE is 0: 


MRC p15, @, <Rt>, c2, c@, 1 ; Read TTBR1 into Rt 
MCR p15, ©, <Rt>, c2, c0, 1 ; Write Rt to TTBR1 
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TTBR1 format when using the Long-descriptor translation table format 
The following figure shows the TTBR1 bit assignments when TTBCR.EAE is 1. 


56:55 48.47 0 


63 
RESO | ASID | BADDR[47:x] 


Figure 4-115 TTBR1 bit assignments, TTBCR.EAE is 1 
The following table shows the TTBR1 bit assignments when TTBCR.EAE is 1. 


Table 4-226 TTBR1 bit assignments, TTBCR.EAE is 1 











Bits |Name Function 
[63:56] | - Reserved, RESO. 
[55:48] | ASID An ASID for the translation table base address. The TTBCR.A1 field selects either TTBRO.ASID or 


TTBRI.ASID. 





[47:0] | BADDR[47:x] | Translation table base address, bits[47:x]. Bits [x-1:0] are RESO. 

x 1s based on the value of TTBCR.TOSZ, and is calculated as follows: 
¢ IfTTBCR.TOSZ is 0 or 1, x = 5 - TTBCR.TOSZ. 

e IfTTBCR.TOSZ is greater than 1, x = 14 - TTBCR.TOSZ. 


The value of x determines the required alignment of the translation table, that must be aligned to 2x bytes. 


If bits [x-1:3] are not all zero, this is a misaligned Translation Table Base Address. Its effects are 
CONSTRAINED UNPREDICTABLE, where bits [x-1:0] are treated as if all the bits are zero. The value read back 
from those bits is the value written. 

















To access the 64-bit TTBR1 when TTBCR.EAE = 1: 


MRRC p15, 1, <Rt>, <Rt2>, c2 ; Read 64-bit TTBR1 into Rt (low word) and Rt2 (high word) 
MCRR p15, 1, <Rt>, <Rt2>, c2 ; Write Rt (low word) and Rt2 (high word) to 64-bit TTBR1 


4.5.43 Translation Table Base Control Register 
The TTBCR characteristics are: 


Purpose Determines which of the Translation Table Base Registers defines the base address 
for a translation table walk required for the stage 1 translation of a memory access 
from any mode other than Hyp mode. Also controls the translation table format and, 
when using the Long-descriptor translation table format, holds cacheability and 
shareability information. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - RW |RW |RW | RW RW 


























The processor does not use the implementation-defined bit, TTBCR[30], when using 
the Long-descriptor translation table format, so this bit is REso. 


Configurations TTBCR (NS) is architecturally mapped to AArch64 register TCR_EL1. See 
4.3.55 Translation Control Register, EL] on page 4-147. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 
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Attributes TTBCR is a 32-bit register. 


There are two formats for this register. TTBCR.EAE determines which format of the register is used. 
This section describes: 

+ TTBCR format when using the Short-descriptor translation table format on page 4-278. 

e TTBCR format when using the Long-descriptor translation table format on page 4-278. 


TTBCR format when using the Short-descriptor translation table format 


The following figure shows the TTBCR bit assignments when TTBCR.EAE is 0. 


31 30 65432 0 
L_EAE PD1— L— RESO 
PDO 


Figure 4-116 TTBCR bit assignments, TTBCR.EAE is 0 
The following table shows the TTBCR bit assignments when TTBCR.EAE is 0. 


Table 4-227 TTBCR bit assignments, TTBCR.EAE is 0 





Bits | Name | Function 





[51] |EAE | Extended Address Enable. 


(2 Use the 32-bit translation system, with the Short-descriptor translation table format. 





pm 

Ww 

2 

lon 

oe 
1 


Reserved, RESO. 





[5] PD1 Translation table walk disable for translations using TTBR1. This bit controls whether a translation table walk is 
performed on a TLB miss for an address that is translated using TTBR1. The possible values are: 


7) Perform translation table walks using TTBR1. 


1 A TLB miss on an address that is translated using TTBR1 generates a Translation fault. No translation 
table walk is performed. 





[4] PDO _ | Translation table walk disable for translations using TTBRO. This bit controls whether a translation table walk is 
performed on a TLB miss for an address that is translated using TTBRO. The possible values are: 


7) Perform translation table walks using TTBRO. 


1 A TLB miss on an address that is translated using TTBRO generates a Translation fault. No translation 
table walk is performed. 





[3] - Reserved, RESO. 





[2:0] |N Indicates the width of the base address held in TTBRO. In TTBRO, the base address field is bits[31:14-N]. The value 
of N also determines: 

e Whether TTBRO or TTBRI1 is used as the base address for translation table walks. 

e The size of the translation table pointed to by TTBRO. 


N can take any value from 0 to 7, that is, from 0b000 to 0b111. 
When N has its reset value of 0, the translation table base is compatible with ARMv5 and ARMv6. 


Resets to 0. 

















TTBCR format when using the Long-descriptor translation table format 
The following figure shows the TTBCR bit assignments when TTBCR.EAE is 1. 
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31 30 29 28 27 26 25 24 23 22 21 1918 161514131211109 8 7 6 3 2 0 





L— RESO L—EPD1 L—EPDO 
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Figure 4-117 TTBCR bit assignments, TTBCR.EAE is 1 


The following table shows the TTBCR bit assignments when TTBCR.EAE is 1. 


Table 4-228 TTBCR bit assignments, TTBCR.EAE is 1 





Bits Name |Function 





[31] EAE Extended Address Enable: 


1 Use the 40-bit translation system, with the Long-descriptor translation table format. 





[30] - Reserved, RESO. 





[29:28] | SH1 Shareability attribute for memory associated with translation table walks using TTBR1: 
@bee Non-shareable. 

0b10 Outer Shareable. 

@b11 Inner Shareable. 

Other values are reserved. 


Resets to 0. 





[27:26] | ORGN1 | Outer cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


Resets to 0. 





[25:24] | IRGN1 | Inner cacheability attribute for memory associated with translation table walks using TTBR1: 


@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Resets to 0. 





[23] EPD1 _ | Translation table walk disable for translations using TTBR1. This bit controls whether a translation table walk is 
performed on a TLB miss for an address that is translated using TTBR1: 
e Perform translation table walks using TTBR1. 


1 A TLB miss on an address that is translated using TTBR1 generates a Translation fault. No translation 
table walk is performed. 























[22] Al Selects whether TTBRO or TTBR1 defines the ASID: 
(2 TTBRO.ASID defines the ASID. 
1 TTBR1.ASID defines the ASID. 
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Table 4-228 TTBCR bit assignments, TTBCR.EAE is 1 (continued) 





Bits Name _ | Function 





[21:19] | - Reserved, RESO. 





[18:16] ]|TISZ |The size offset of the memory region addressed by TTBRI. The region size is 23%T1SZ bytes. 


Resets to 0. 





[15:14] | - Reserved, RESO. 








[13:12] | SHO Shareability attribute for memory associated with translation table walks using TTBRO: 


@bee Non-shareable. 
@b10 Outer Shareable. 
0b11 Inner Shareable. 


Other values are reserved. 


Resets to 0. 





[11:10] | ORGNO | Outer cacheability attribute for memory associated with translation table walks using TTBRO: 


0b00 Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

0b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


Resets to 0. 





[9:8] |IRGNO | Inner cacheability attribute for memory associated with translation table walks using TTBRO: 


@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 


Resets to 0. 





7 EPDO Translation table walk disable for translations using TTBRO. This bit controls whether a translation table walk is 
g 
performed on a TLB miss for an address that is translated using TTBRO: 


(2] Perform translation table walks using TTBRO. 


1 A TLB miss on an address that is translated using TTBRO generates a Translation fault. No translation 
table walk is performed. 





Reserved, RESO. 


[6:3] 





[2:0] |TOSZ |The size offset of the memory region addressed by TTBRO. The region size is 232-19S2 bytes. 


Resets to 0. 

















To access the TTBCR: 


MRC p15,0,<Rt>,c2,c@,@ ; Read TTBCR into Rt 
MCR p15,0,<Rt>,c2,c0,@ ; Write Rt to TTBCR 


4.5.44 Hyp Translation Control Register 
The HTCR characteristics are: 
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Purpose Controls translation table walks required for the stage 1 translation of memory 
accesses from Hyp mode, and holds cacheability and shareability information for 
the accesses. 


Usage constraints This register is accessible as follows: 








ELO |ELO|EL1 | EL1|EL2|EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. J- [Rw RW : 


























Configurations | HTCR is architecturally mapped to AArch64 register TCR_EL2. See 
4.3.56 Translation Control Register, EL2 on page 4-150. 


Attributes HTCR is a 32-bit register. 


The following figure shows the HTCR bit assignments. 


31 30 24 23 22 14131211109 8 7 32 0 
L_Rres1 L_Rres1 ORGNo — L_|IRGNO 


Figure 4-118 HTCR bit assignments 
The following table shows the HTCR bit assignments. 


Table 4-229 HTCR bit assignments 









































Bits |Name | Function 

[31] - Reserved, RES1. 

[30:24] | - Reserved, RESO. 

[23] - Reserved, RES1. 

[22:14] | - Reserved, RESO. 

[13:12] | SHO Shareability attribute for memory associated with translation table walks using TTBRO. The possible values are: 
@bee Non-shareable. 
@be1 Reserved. 
@b10 Outer shareable. 
@b11 Inner shareable. 

[11:10] | ORGNO | Outer cacheability attribute for memory associated with translation table walks using TTBRO. The possible values 
are: 
@bee Normal memory, Outer Non-cacheable. 
Q@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 
0b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
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Table 4-229 HTCR bit assignments (continued) 





Bits Name _ | Function 





[9:8] | IRGNO | Inner cacheability attribute for memory associated with translation table walks using TTBRO. The possible values 
are: 

@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 








[7:3] - Reserved, RESO. 








[2:0] |TOSZ | Size offset of the memory region addressed by TTBRO. The region size is 262-TS!ZE) bytes. 














The processor does not use the implementation-defined bit, HTCR[30], so this bit is REso. 
To access the HTCR: 


MRC p15, 4, <Rt>, c2, c@, 2; Read HTCR into Rt 
MCR p15, 4, <Rt>, c2, c@, 2; Write Rt to HTCR 


4.5.45 Virtualization Translation Control Register 
The VTCR characteristics are: 


Purpose Controls the translation table walks required for the stage 2 translation of memory 
accesses from Non-secure modes other than Hyp mode, and holds cacheability and 
shareability information for the accesses. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





z a: 6 -  |RW [RW : 


























Used in conjunction with VTTBR, that defines the translation table base address for 
the translations. 


Configurations VTCR is architecturally mapped to AArch64 register VTCR_EL2. See 
4.3.57 Virtualization Translation Control Register, EL2 on page 4-152. 


This register is accessible only at EL2 or EL3. 
Attributes VTCR is a 32-bit register. 


The following figure shows the VTCR bit assignments. 


31 30 14131211109 876543 
L ReEs1 ORGNO | L RESO 
es 


Figure 4-119 VTCR bit assignments 
The following table shows the VTCR bit assignments. 
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Table 4-230 VTCR bit assignments 





Bits 


Name 


Function 





[31] 


Reserved, RES1. 





[30:14] 


Reserved, RESO. 





[13:12] 


SHO 


Shareability attribute for memory associated with translation table walks using TTBRO. 


@bee 
@be1 
@b10 
@b11 


Non-shareable. 
Reserved. 
Outer Shareable. 


Inner Shareable. 





[11:10] 


ORGNO 


Outer cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee 
@be1 
0b10 
@b11 


Normal memory, Outer Non-cacheable. 

Normal memory, Outer Write-Back Write-Allocate Cacheable. 
Normal memory, Outer Write-Through Cacheable. 

Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] 


IRGNO 


Inner cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee 
@be1 
@b10 
@b11 


Normal memory, Inner Non-cacheable. 
Normal memory, Inner Write-Back Write-Allocate Cacheable. 
Normal memory, Inner Write-Through Cacheable. 


Normal memory, Inner Write-Back no Write-Allocate Cacheable. 





[7:6] 


SLO 


Starting level for translation table walks using VTTBR: 


@bee 
@be1 


Start at second level. 


Start at first level. 





[5] 


Reserved, RESO. 





[4] 


Sign extension bit. This bit must be programmed to the value of TOSZ[3]. If it is not, then the stage 2 TOSZ value is 


treated as an UNKNOWN value within the legal range that can be programmed. 





[3:0] 








TOSZ 





The size offset of the memory region addressed by TTBRO. The region size is 232-T™S2 bytes, 








4.5.46 


To access the VTCR: 


MRC p15, 4, <Rt>, c2, c1, 2; Read VTCR into Rt 
MCR p15, 4, <Rt>, c2, c1, 2; Write Rt to VTCR 


Domain Access Control Register 


The DACR characteristics are: 


Purpose Defines the access permission for each of the sixteen memory domains. 

Usage This register is accessible as follows: 

constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW IRW |RW | RW RW 
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Configurations DACR (NS) is architecturally mapped to AArch64 register DACR32_EL2. See 
4.3.58 Domain Access Control Register on page 4-154. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


DACR has no function when TTBCR.EAE is set to 1, to select the Long-descriptor 
translation table format. 


Attributes DACR is a 32-bit register. 


The following figure shows the DACR bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16:15 14 13 1211 109 8 76543 2 1 





Figure 4-120 DACR bit assignments 


The following table shows the DACR bit assignments. 


Table 4-231 DACR bit assignments 





Bits |Name Function 





[31:0] | D<n>, bits [2n+1:2n], for | Domain n access permission, where n = 0 to 15. Permitted values are: 


aS @be@e No access. Any access to the domain generates a Domain fault. 


@be@1 Client. Accesses are checked against the permission bits in the translation tables. 


@b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value @b1@ is reserved. 














To access the DACR: 


MRC p15, ©, <Rt>, c3, c@, @ ; Read DACR into Rt 
MCR p15, ©, <Rt>, c3, c0, © ; Write Rt to DACR 


4.5.47 Hyp System Trap Register 
The HSTR characteristics are: 


Purpose Controls trapping to Hyp mode of Non-secure accesses, at EL1 or lower, of use of 
T32EE, or the CP15 primary registers, {c0-c3,c5-cl3,c15}. 


Usage constraints This register is accessible as follows: 








ELO |ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |. [Rw RW : 


























Configurations HSTR is architecturally mapped to AArch64 register HSTR_EL2. 
This register is accessible only at EL2 or EL3. 
Attributes HSTR is a 32-bit register. 


The following figure shows the HSTR bit assignments. 
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31 17 16 15 14 13 1211109876543210 





























Figure 4-121 HSTR bit assignments 


The following table shows the HSTR bit assignments. 


Table 4-232 HSTR bit assignments 









































Bits | Name | Function 

[31:17] | - Reserved, RESO. 

[16] TTEE | Trap T32EE. This value is: 
(4) T32EE is not supported. 

[15] T15 Trap coprocessor primary register CRn = 15. The possible values are: 
e Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 15 to Hyp mode. 
The reset value is 0. 

[14] - Reserved, RESO. 

[13] T13 Trap coprocessor primary register CRn = 13. The possible values are: 
e Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 13 to Hyp mode. 
The reset value is 0. 

[12] T12 Trap coprocessor primary register CRn = 12. The possible values are: 
e Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 12 to Hyp mode. 
The reset value is 0. 

[11] T11 Trap coprocessor primary register CRn = 11. The possible values are: 
(2) Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 11 to Hyp mode. 
The reset value is 0. 
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Table 4-232 HSTR bit assignments (continued) 





Bits 


Name 


Function 





[10] 


T10 


Trap coprocessor primary register CRn = 10. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 10 to Hyp mode. 


The reset value is 0. 





[9] 


T9 


Trap coprocessor primary register CRn = 9. The possible values are: 


(2) Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 9 to Hyp mode. 


The reset value is 0. 





[8] 


T8 


Trap coprocessor primary register CRn = 8. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 8 to Hyp mode. 


The reset value is 0. 





[7] 


T7 


Trap coprocessor primary register CRn = 7. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 7 to Hyp mode. 


The reset value is 0. 





T6 


Trap coprocessor primary register CRn = 6. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 6 to Hyp mode. 


The reset value is 0. 





[5] 


T5 


Trap coprocessor primary register CRn = 5. The possible values are: 


(2) Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 5 to Hyp mode. 


The reset value is 0. 





Reserved, RESO. 





[3] 


T3 


Trap coprocessor primary register CRn = 3. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 3 to Hyp mode. 


The reset value is 0. 





[2] 








T2 





Trap coprocessor primary register CRn = 2. The possible values are: 


e Has no effect on Non-secure accesses to CP15 registers. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = 2 to Hyp mode. 


The reset value is 0. 
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Table 4-232 HSTR bit assignments (continued) 



























































Bits |Name | Function 
[1] T1 Trap coprocessor primary register CRn = 1. The possible values are: 
e Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 1 to Hyp mode. 
The reset value is 0. 
[0] TO Trap coprocessor primary register CRn = 0. The possible values are: 
e Has no effect on Non-secure accesses to CP15 registers. 
1 Trap valid Non-secure accesses to coprocessor primary register CRn = 0 to Hyp mode. 
The reset value is 0. 
To access the HSTR: 
MRC p15, 4, <Rt>, c1, c1, 3 ; Read HSTR into Rt 
MCR p15, 4, <Rt>, c1, c1, 3 ; Write Rt to HSTR 
4.5.48 Hyp Auxiliary Configuration Register 
The processor does not implement HACR, so this register is always RESO. 
4.5.49 Data Fault Status Register 
The DFSR characteristics are: 
Purpose Holds status information about the last data fault. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW IRW |RW | RW RW 
Configurations DFSR (NS) is architecturally mapped to AArch64 register ESR_EL1. 
If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 
There are two formats for this register. The current translation table format 
determines which format of the register is used. 
Attributes DFSR is a 32-bit register. 
This section describes: 
¢ DFSR when using the Short-descriptor translation table format on page 4-287. 
e DFSR when using the Long-descriptor translation table format on page 4-289. 
DFSR when using the Short-descriptor translation table format 
The following figure shows the DFSR bit assignments when using the Short-descriptor translation table 
format. 
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Figure 4-122 DFSR bit assignments for Short-descriptor translation table format 


The following table shows the DFSR bit assignments when using the Short-descriptor translation table 
format. 


Table 4-233 DFSR bit assignments for Short-descriptor translation table format 





Bits 


Name 


Function 





[31:14] 


Reserved, RESO. 





[13] 


CM 


Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance operation 
generated the fault: 


e Abort not caused by a cache maintenance operation. 


1 Abort caused by a cache maintenance operation. 





[12] 


ExT 


External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 


(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11] 


WnR 


Write not Read bit. This field indicates whether the abort was caused by a write or a read access: 
e Abort caused by a read access. 


1 Abort caused by a write access. 


For faults on CP15 cache maintenance operations, including the VA to PA translation operations, this bit always 
returns a value of 1. 





[10] 


FS[4] 


Part of the Fault Status field. See bits [3:0] in this table. 





LPAE 


On taking a Data Abort exception, this bit is set as follows: 
e Using the Short-descriptor translation table formats. 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 





[8] 











Reserved, RESO. 
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Table 4-233 DFSR bit assignments for Short-descriptor translation table format (continued) 











Bits |Name | Function 
[7:4] Domain | Specifies which of the 16 domains, D15-D0, was being accessed when a data fault occurred. 
For permission faults that generate Data Abort exception, this field is UNKNOWN. ARMv8 deprecates any use of the 
domain field in the DFSR. 
[3:0] FS[3:0] | Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is reserved: 
0b00001 Alignment fault. 
@beee10 Debug event. 
0b00011 Access flag fault, section. 
0b00100 Instruction cache maintenance fault. 
0b00101 Translation fault, section. 
0b00110 Access flag fault, page. 
0b00111 Translation fault, page. 
0b01000 Synchronous external abort, non-translation. 
0b01001 Domain fault, section. 
0b01011 Domain fault, page. 
0b01100 Synchronous external abort on translation table walk, first level. 
0b01101 Permission fault, section. 
@be1110 Synchronous external abort on translation table walk, second level. 
Qbe1111 Permission fault, second level. 
0b10000 TLB conflict abort. 
0b10101 LDREX or STREX abort. 
@b10110 Asynchronous external abort. 
0b11000 Asynchronous parity error on memory access. 
0b11001 Synchronous parity error on memory access. 
@b11100 Synchronous parity error on translation table walk, first level. 
0b11110 Synchronous parity error on translation table walk, second level. 

















DFSR when using the Long-descriptor translation table format 


The following figure shows the DFSR bit assignments when using the Long-descriptor translation table 
format. 


31 14131211109 8 


[See 
Bere: 
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CM 


Figure 4-123 DFSR bit assignments for Long-descriptor translation table format 


The following table shows the DFSR bit assignments when using the Long-descriptor translation table 
format. 
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Table 4-234 DFSR bit assignments for Long-descriptor translation table format 





Bits Name | Function 








[31:14] | - Reserved, RESO. 

[13] CM Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance operation generated 
the fault: 
(2) Abort not caused by a cache maintenance operation. 
1 Abort caused by a cache maintenance operation. 





[12] ExT | External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 


(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11] WnR_ | Write not Read bit. This field indicates whether the abort was caused by a write or a read access: 
(4) Abort caused by a read access. 


1 Abort caused by a write access. 


For faults on CP15 cache maintenance operations, including the VA to PA translation operations, this bit always 
returns a value of 1. 





[10] - Reserved, RESO. 





[9] LPAE |On taking a Data Abort exception, this bit is set as follows: 
e Using the Short-descriptor translation table formats. 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 





[8:6] - Reserved, RESO. 





[5:0] | Status | Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is reserved. 


@beeeeee Address size fault in TTBRO or TTBRI. 

Q@b@0@01LL Translation fault, LL bits indicate level. 

@b@01@LL Access fault flag, LL bits indicate level. 

Q@b@011LL Permission fault, LL bits indicate level. 

0b010009 Synchronous external abort. 

0b010001 Asynchronous external abort. 

@b@1@1LL Synchronous external abort on translation table walk, LL bits indicate level. 
0b0110009 Synchronous parity error on memory access. 

@b@11001 Asynchronous parity error on memory access (DFSR only). 

@b@111LL Synchronous parity error on memory access on translation table walk, first level, LL bits indicate level. 
@b10e001 Alignment fault. 

0b100019 Debug event. 

0b1100009 TLB conflict abort. 

@b110101 LDREX or STREX abort. 

















The following table shows how the LL bits in the Status field encode the lookup level associated with the 
MMU fault. 
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Table 4-235 Encodings of LL bits associated with the MMU fault 


To access the DFSR: 


MRC p15, ©, <Rt>, c5, c@, @; Read DFSR into Rt 


MCR p15, ©, <Rt>, c5, c0, @; Write Rt to DFSR 


4.5.50 Instruction Fault Status Register 


The IFSR characteristics are: 





Bits | Meaning 





ObO | Reserved 





Qb@1 | Level 1 





@b10 | Level 2 





0b11 | Level 3 




















Purpose Holds status information about the last instruction fault. 

Usage This register is accessible as follows: 

constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW IRW |RW |RW RW 


























Configurations IFSR (NS) is architecturally mapped to AArch64 register IFSR32_EL2. See 
4.3.65 Instruction Fault Status Register, EL2 on page 4-159. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 


register. 


Attributes IFSR is a 32-bit register. 


There are two formats for this register. The current translation table format determines which format of 


the register is used. This section describes: 


¢ IFSR when using the Short-descriptor translation table format on page 4-291. 
e JIFSR when using the Long-descriptor translation table format on page 4-292. 


IFSR when using the Short-descriptor translation table format 


The following figure shows the IFSR bit assignments when using the Short-descriptor translation table 


format. 
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Figure 4-124 IFSR bit assignments for Short-descriptor translation table format 


The following table shows the IFSR bit assignments when using the Short-descriptor translation table 


format. 
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Table 4-236 IFSR bit assignments for Short-descriptor translation table format 












































Bits /Name | Function 
[31:13] | - Reserved, RESO. 
[12] ExT External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 
(2 External abort marked as DECERR. 
1 External abort marked as SLVERR. 
For aborts other than external aborts this bit always returns 0. 
[11] - Reserved, RESO. 
[10] FS[4] _ | Part of the Fault Status field. See bits [3:0] in this table. 
[9] LPAE |On taking a Data Abort exception, this bit is set as follows: 
(2 Using the Short-descriptor translation table formats. 
1 Using the Long-descriptor translation table formats. 
Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 
[8:4] - Reserved, RESO. 
[3:0] | FS[3:0] | Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is reserved: 
@be0010 Debug event. 
@beee11 Access flag fault, section. 
@bee101 Translation fault, section. 
@bee110 Access flag fault, page. 
@bee111 Translation fault, page. 
0b01000 Synchronous external abort, non-translation. 
0b01001 Domain fault, section. 
0b01011 Domain fault, page. 
0b01100 Synchronous external abort on translation table walk, first level. 
0b01101 Permission Fault, section. 
0b01110 Synchronous external abort on translation table walk, second level. 
0b01111 Permission fault, page. 
0b10000 TLB conflict abort. 
0b11001 Synchronous parity error on memory access. 
@b11100 Synchronous parity error on translation table walk, first level. 
@b11110 Synchronous parity error on translation table walk, second level. 
IFSR when using the Long-descriptor translation table format 
The following figure shows the IFSR bit assignments when using the Long-descriptor translation table 
format. 
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31 131211109 8 65 0 
| fem Pee | soe | 
ExT— L_ PAE 


Figure 4-125 IFSR bit assignments for Long-descriptor translation table format 


The following table shows the IFSR bit assignments when using the Long-descriptor translation table 
format. 


Table 4-237 IFSR bit assignments for Long-descriptor translation table format 





Bits 


Name 


Function 





[31:13] 


Reserved, RESO. 





[12] 


ExT 


External abort type. This field indicates whether an AXI Decode or Slave error caused an abort: 


(2) External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11:10] 


Reserved, RESO. 





[9] 


LPAE 


On taking a Data Abort exception, this bit is set as follows: 
e Using the Short-descriptor translation table formats. 


1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore software can set 
this bit to 0 or 1 without affecting operation. 





[8:6] 


Reserved, RESO. 





[5:0] 








Status 





Fault Status bits. This field indicates the type of exception generated. Any encoding not listed is reserved: 


@beeeeee Address size fault in TTBRO or TTBRI. 

@bee01LL Translation fault, LL bits indicate level. 

@bee@1@LL Access fault flag, LL bits indicate level. 

@b@011LL Permission fault, LL bits indicate level. 

0b0100009 Synchronous external abort. 

@b@1@1LL Synchronous external abort on translation table walk, LL bits indicate level. 
0b011000 Synchronous parity error on memory access. 

@b@111LL Synchronous parity error on memory access on translation table walk, LL bits indicate level. 
0b100001 Alignment fault. 

0b100010 Debug event. 

0b1100009 TLB conflict abort. 
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The following table shows how the LL bits in the Status field encode the lookup level associated with the 


MMU fault. 


Table 4-238 Encodings of LL bits associated with the MMU fault 


Note 








Bits | Meaning 





@b@@ | Reserved 





Qb@1 | Level 1 





Qb10 | Level 2 











0b11 | Level 3 








If a Data Abort exception is generated by an instruction cache maintenance operation when the Long- 
descriptor translation table format is selected, the fault is reported as a Cache Maintenance fault in the 
DFSR or HSR with the appropriate Fault Status code. For such exceptions reported in the DFSR, the 


corresponding IFSR is UNKNOWN. 





To access the IFSR: 


MRC p15, ©, <Rt>, c5, c@, 1; Read IFSR into Rt 
MCR p15, ©, <Rt>, c5, c@, 1; Write Rt to IFSR 


Register access is encoded as follows: 


Table 4-239 IFSR access encoding 





























coproc | opc1 | CRn | CRm | opc2 
1111 000 | 0101 | 0000 | 001 
4.5.51 Auxiliary Data Fault Status Register 
The processor does not implement ADFSR, so this register is always RESO. 
4.5.52 Auxiliary Instruction Fault Status Register 
The processor does not implement AIFSR, so this register is always RESO. 
4.5.53 Hyp Auxiliary Data Fault Status Syndrome Register 
The processor does not implement HADFSR, so this register is always RESO. 
4.5.54 Hyp Auxiliary Instruction Fault Status Syndrome Register 
The processor does not implement HAIFSR, so this register is always RESO. 
4.5.55 Hyp Syndrome Register 
The HSR characteristics are: 
Purpose Holds syndrome information for an exception taken to Hyp mode. 
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Usage constraints This register is accessible as follows: 








ELO |ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |- [Rw RW : 


























Configurations HSR is architecturally mapped to AArch64 register ESR_EL2. See 4.3.66 Exception 
Syndrome Register, EL2 on page 4-163. 


This register is accessible only at EL2 or EL3. 
Attributes HSR is a 32-bit register. 


The following figure shows the HSR bit assignments. 


31 26 25 24 0 
be IL 


Figure 4-126 HSR bit assignments 
The following table shows the HSR bit assignments. 


Table 4-240 HSR bit assignments 





Bits 


Name | Function 





[31:26] 


EC Exception Class. The exception class for the exception that is taken in Hyp mode. See the ARM® Architecture 
Reference Manual ARMVv8, for ARMv8-A architecture profile for more information. 





[25] 


IL Instruction Length. See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for 
more information. 





[24:0] 





ISS Instruction Specific Syndrome. See the ARM” Architecture Reference Manual ARMV8, for ARMv8-A architecture 
profile for more information. The interpretation of this field depends on the value of the EC field. See Encoding of 
ISS[24:20] when HSR[31:30] is 0600 on page 4-295. 











4.5.56 


Encoding of ISS[24:20] when HSR[31:30] is 0b00 


For EC values that are nonzero and have the two most-significant bits 0b00, ISS[24:20] provides the 
condition field for the trapped instruction, together with a valid flag for this field. 


The encoding of this part of the ISS field is: 
CV, ISS[24] Condition valid. Possible values of this bit are: 


[2] The COND field is not valid. 
1 The COND field is valid. 


When an instruction is trapped, CV is set to 1. 


COND, The Condition field for the trapped instruction. This field is valid only when CV is set 
ISS[23:20] to 1. 


If CV is set to 0, this field is REso. 
When an instruction is trapped, the COND field is set to the condition the instruction was executed with. 


Data Fault Address Register 
The DFAR characteristics are: 
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Purpose 


Abort exception. 


Usage 
constraints 


Configurations 


This register is accessible as follows: 


4 System Control 


4.5 AArch32 register descriptions 


Holds the virtual address of the faulting address that caused a synchronous Data 





























ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 

(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
DFAR(S) | - s |e RW |- l- RW 
DFAR(NS) | - - |RW |- | RW | RW : 











4.3.68 Fault Address Register, ELI on page 4-165. 


DFAR(NS) is architecturally mapped to AArch64 register FAR_EL1[31:0]. See 


DFAR(S) is architecturally mapped to AArch32 register HDFAR. See 4.5.58 Hyp 


Data Fault Address Register on page 4-297. 


DFAR(S) is architecturally mapped to AArch64 register FAR_EL2[31:0]. See 
4.3.69 Fault Address Register, EL2 on page 4-166. 


Attributes 


DFAR is a 32-bit register. 


The following figure shows the DFAR bit assignments. 


31 


0 


VA of faulting address of synchronous Data Abort exception 


Figure 4-127 DFAR bit assignments 


The following table shows the DFAR bit assignments. 


Table 4-241 DFAR bit assignments 





Bits 


Name | Function 








[31:0] 





VA 


The Virtual Address of faulting address of synchronous Data Abort exception 








To access the DFAR: 


MRC p15, @, <Rt>, c6, c@, @ ; Read DFAR into Rt 
MCR p15, ©, <Rt>, c6, c0, © ; Write Rt to DFAR 


4.5.57 


Instruction Fault Address Register 


The IFAR characteristics are: 


Purpose 


Abort exception. 


Usage 
constraints 


This register is accessible as follows: 


Holds the virtual address of the faulting address that caused a synchronous Prefetch 





























ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 

(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
IFAR(S) |- = Wie RW |- l- RW 
IFAR(NS) | - - {RW |- | RW | RW : 
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Configurations IFAR(NS) is architecturally mapped to AArch64 register FAR_EL1[63:32]. See 
4.3.68 Fault Address Register, ELI on page 4-165. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


IFAR(S) is architecturally mapped to AArch32 register HIFAR. 


IFAR(S) is architecturally mapped to AArch64 register FAR_EL2[63:32]. See 
4.3.69 Fault Address Register, EL2 on page 4-166. 


Attributes IFAR is a 32-bit register. 


The following figure shows the IFAR bit assignments. 


31 0 


VA of faulting address of synchronous Prefetch Abort exception 


Figure 4-128 IFAR bit assignments 


The following table shows the IFAR bit assignments. 


Table 4-242 IFAR bit assignments 





Bits | Name | Function 





[31:0] | VA The Virtual Address of faulting address of synchronous Prefetch Abort exception 

















To access the IFAR: 


MRC p15, @, <Rt>, c6, c@, 2; Read IFAR into Rt 
MCR p15, ©, <Rt>, c6, c@, 2; Write Rt to IFAR 


4.5.58 Hyp Data Fault Address Register 
The HDFAR characteristics are: 








Purpose Holds the virtual address of the faulting address that caused a synchronous Data 
Abort exception that is taken to Hyp mode. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) 
- - - RW |RW |- 


























An execution in a Non-secure EL] state, or in Secure state, makes the HDFAR 
UNKNOWN. 


Configurations © HDFAR is architecturally mapped to AArch64 register FAR_EL2[31:0] when EL3 is 
AArch64. See 4.3.69 Fault Address Register, EL2 on page 4-166. 


HDFAR (S) is architecturally mapped to AArch32 register DFAR (S). See 4.5.56 
Data Fault Address Register on page 4-295. 


Attributes HDFAR is a 32-bit register. 


The following figure shows the HDFAR bit assignments. 
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0 


VA of faulting address of synchronous Data Abort exception 


Figure 4-129 HDFAR bit assignments 


The following table shows the HDFAR bit assignments. 





Bits 


Table 4-243 HDFAR bit assignments 


Name | Function 








[31:0] 





VA The Virtual Address of faulting address of synchronous Data Abort exception 








To access the HDFAR: 


MRC p15, 4, <Rt>, c6, c@, @ ; Read HDFAR into Rt 
MCR p15, 4, <Rt>, c6, c0, © ; Write Rt to HDFAR 


4.5.59 Hyp Instruction Fault Address Register 
The HIFAR characteristics are: 


Purpose Holds the virtual address of the faulting address that caused a synchronous Prefetch 
Abort exception that is taken to Hyp mode. 


Usage This register is accessible as follows: 

constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z aE - |RW | RW : 
































Execution in any Non-secure mode other than Hyp mode makes HIFAR UNKNown. 


Configurations HIFAR is architecturally mapped to AArch64 register FAR_EL2[63:32]. See 
4.3.69 Fault Address Register, EL2 on page 4-166. 


HIFAR is architecturally mapped to AArch32 register IFAR (S). See 4.5.57 
Instruction Fault Address Register on page 4-296. 


Attributes HIFAR is a 32-bit register. 


The following figure shows the HIFAR bit assignments. 


31 


0 


VA of faulting address of synchronous Prefetch Abort exception 


Figure 4-130 HIFAR bit assignments 


The following table shows the HIFAR bit assignments. 


Table 4-244 HIFAR bit assignments 





Bits | Name | Function 











[31:0] | VA 





The Virtual Address of faulting address of synchronous Prefetch Abort exception 








To access the HIFAR: 


MRC p15, 4, <Rt>, c6, c@, 2 ; Read HIFAR into Rt 
MCR p15, 4, <Rt>, c6, c@, 2 ; Write Rt to HIFAR 
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Hyp IPA Fault Address Register 
The HPFAR characteristics are: 








Purpose Holds the faulting IPA for some aborts on a stage 2 translation that is taken to Hyp 
mode. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
p a. (a - |RW | RW : 


























Execution in any Non-secure mode other than Hyp mode makes HPFAR UNKNOWN. 


Configurations HPFAR is architecturally mapped to AArch64 register HPFAR_EL2[31:0]. See 
4.3.70 Hypervisor IPA Fault Address Register, EL2 on page 4-167. 


Attributes HPFAR is a 32-bit register. 


The following figure shows the HPFAR bit assignments. 
31 4 3 0 


FIPA[39:12] 


Figure 4-131 HPFAR bit assignments 
The following table shows the HPFAR bit assignments. 


Table 4-245 HPFAR bit assignments 





Bits | Name Function 





[31:4] | FIPA[39:12] | Bits [39:12] of the faulting Intermediate Physical Address 





[3:0] |- Reserved, RESO 

















To access the HPFAR: 


MRC p15, 4, <Rt>, c6, c@, 4 ; Read HPFAR into Rt 
MCR p15, 4, <Rt>, c6, c@, 4 ; Write Rt to HPFAR 


Physical Address Register 
The processor does not use any implementation-defined bits in the 32-bit format or 64-bit format PAR. 
Bit[8] is Reso. See the ARM® Architecture Reference Manual ARMv8, for ARMv8-A architecture profile 
for more information. 

L2 Control Register 
The L2CTLR characteristics are: 





Purpose Provides IMPLEMENTATION DEFINED control options for the L2 memory system. 
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Usage 
constraints 


Configurations 


Attributes 


4 System Control 
4.5 AArch32 register descriptions 


This register is accessible as follows: 





ELO | ELO|EL1 |EL1/EL2|EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - RW |RW |RW | RW RW 





























Note 
This register is write accessible in EL] if: 


e ACTLR_EL3.EN_ L2CTLR is 1 and 
e ACTLR_EL2.EN L2CTLR is 1 or SCR_EL3.NS is 0 


If write access is not possible, then L2CTLR is trapped to the lowest exception level 
that denied access (EL2 or EL3). 





L2CTLR is architecturally mapped to the AArch64 L2CTLR_ELI register. See 
4.3.71 L2 Control Register on page 4-168. 


There is only one L2CTLR for the Cortex-A73 processor. 
There is one copy of this register that is used in both Secure and Non-secure states. 


L2CTLR is a 32-bit register. 


The following figure shows the L2CTLR bit assignments. 


Monitor L2ARSTDISABLE 

RESO 

Number of cores 

RESO 

L2 prefetcher full mode disable 
L2 prefetcher disable 

L2 evict disable 

L2 ECC disable 


2726 25 24 2322 2120191817 1514 1211 98 65 3 2 0 





Flush index 
increment 


LL2 data RAM write latency 
L2 data RAM read latency 
L2 data RAM setup latency 


L2 tag RAM write latency 














L2 tag RAM read latency 








L2 tag RAM setup latency 
L2 data cache disable 





= 








Figure 4-132 L2CTLR bit assignments 


The following table shows the L2CTLR bit assignments. 


Table 4-246 L2CTLR bit assignments 





Bits Name 


Function 





[31] L2RSTDISABLE 


Monitor L2RSTDISABLE. 





[30:27] | Flush index increment 


Flush index increment. 


The reset value is 0. 











[26] |- 


Reserved, RESO. 














ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 4-300 


reserved. 
Non-Confidential 


4 System Control 
4.5 AArch32 register descriptions 


Table 4-246 L2CTLR bit assignments (continued) 





Bits Name Function 





[25:24] | Number of cores Number of cores present: 

@bee@ One core, core 0. 

@b@1 Two cores, core 0 and core 1. 
Q@b1@ Three cores, cores 0 to 2. 
Q@b11 Four cores, cores 0 to 3. 


These bits are read-only and the value of this field is set to the number of cores present in 
the configuration. 





[23] - Reserved, RESO. 





[22] L2 prefetcher full mode disable | Disables the full mode of the L2 prefetcher: 


Q Enables full mode. 
1 Disables full mode. 


The reset value is 0. 
Note 
This bit has no effect when the L2 prefetcher disable bit is set to 1. 








[21] L2 prefetcher disable Disables the L2 prefetcher: 
(2 Enables prefetcher. 
1 Disables prefetcher. 


The reset value is 0. 








[20] L2 Evict disable Disables evict information that is sent to interconnect: 
(2 Enables evict information. 
1 Disables evict information. 
[19] L2 ECC disable Disables L2 ECC protection: 
(2 Enables ECC protection. 
1 Disables ECC protection. 


The reset value is 0. 





[18] L2 data cache disable’ Disables L2 data cache: 
(2) Enables L2 data cache. 
1 Disables L2 data cache. 


The reset value is 0. 





[17:15] | L2 tag RAM setup latency L2 tag RAM setup latency: 


<n> <n+1>-cycle setup delay from L2 tag RAMs. 





[14:12] | L2 tag RAM read latency L2 tag RAM read latency: 
<n> <n+1>-cycle read delay from L2 tag RAMs. 




















bq The L2 cache must never be disabled in a multi-cluster configuration. 
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Table 4-246 L2CTLR bit assignments (continued) 





Bits Name Function 





[11:9] | L2 tag RAM write Latency L2 tag RAM write latency: 


<n> <n+1>-cycle write delay from L2 tag RAMs. 





[8:6] | L2 data RAM setup Latency L2 data RAM setup latency: 


<n> <n+1>-cycle setup delay from L2 data RAMs. 





[5:3] | L2 data RAM read Latency L2 data RAM read latency: 
<n> <n+1>-cycle read delay from L2 data RAMs. 





[2:0] | L2 data RAM write Latency L2 data RAM write latency: 





<n> <n+1>-cycle write delay from L2 data RAMs. 

















To access the L2CTLR: 


MRC p15, 1, <Rt>, c9, c@, 2; Read L2CTLR into Rt 


4.5.63 L2 Extended Control Register 
The L2ECTLR characteristics are: 


Purpose Provides additional IMPLEMENTATION DEFINED control options for the L2 memory 
system. This register is used for dynamically changing, but implementation specific, 
control bits. 








Usage This register is accessible as follows: 

constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW IRW |RW | RW RW 


























The L2ECTLR can be written dynamically. 
Note 

This register is write accessible in EL1 if: 

e ACTLR_EL3.EN L2CTLR is 1 and 


e ACTLR_EL2.EN EN L2CTLR is 1 or ACTLR_EL3.EN EN L2CTLR is 1 and 
e SCR.NS is 0. 


If write access is not possible, then L2ECTLR is trapped to the lowest exception level 
that denied access (EL2 or EL3). 





Configurations L2ECTLR is architecturally mapped o the AArch64 LZECTLR_ELI register. See 
4.3.72 L2 Extended Control Register on page 4-171. 


There is one copy of this register that is used in both Secure and Non-secure states. 
There is one LZECTLR for the Cortex-A73 processor. 
Attributes L2ECTLR is a 32-bit register. 


The following figure shows the LZECTLR bit assignments. 
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31 30 29 28 543210 


LAXI asynchronous error L2 light sleep mode delay- 
L2 RAM Double-Bit ECC error L2 dynamic retention control 


RESO 


Figure 4-133 L2ECTLR bit assignments 
The following table shows the LZECTLR bit assignments. 


Table 4-247 L2ECTLR bit assignments 


Bits | Name Function 





[B1] |- Reserved, RESO. 





[30] | L2 RAM Double-Bit L2 RAM Double-Bit ECC error indication. The possible values are: 


BOC er e No pending Double-Bit ECC error. 


1 A fatal Double-Bit ECC error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 





[29] | AXI asynchronous AXI asynchronous error indication. The possible values are: 


error f 
(2) No pending asynchronous error. 


1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 





[28:5] | - Reserved, RESO. 





[4:3] | L2 light sleep mode L2 light sleep mode delay. The possible values are: 
delay 


ob0ð 0 clock cycles before L2 RAM enters sleep mode. 

@be1 16 clock cycles before L2 RAM enters sleep mode. 
@b10 32 clock cycles before L2 RAM enters sleep mode. 
@b11 32 clock cycles before L2 RAM enters sleep mode. 





[2:0] |L2 dynamic retention | L2 Data dynamic retention control. The possible values are: 




















control b000 L2 dynamic retention disabled. This is the reset value. 
@be01 2 Generic Timer ticks required before retention entry. 
@be10 8 Generic Timer ticks required before retention entry. 
@be11 32 Generic Timer ticks required before retention entry. 
0b100 64 Generic Timer ticks required before retention entry. 
@b101 128 Generic Timer ticks required before retention entry. 
@b110 256 Generic Timer ticks required before retention entry. 
@b111 512 Generic Timer ticks required before retention entry. 
To access the LZECTLR: 
MRC p15, 1, <Rt>, c9, c@, 3; Read L2ECTLR into Rt 
MCR p15, 1, <Rt>, c9, c@, 3; Write Rt to L2ECTLR 
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4.5 AArch32 register descriptions 


Primary Region Remap Register 


The PRRR characteristics are: 


Purpose 


Usage 
constraints 


Configurations 


Attributes 


Controls the top level mapping of the TEX[0], C, and B memory region attributes. 
This register is accessible as follows: 





EL3 
(SCR.NS = 0) 


ELO 
(NS) 


ELO | EL1 


(NS) 


EL1 
(S) 
RW 


EL2 | EL3 
(SCR.NS = 1) 





RW RW | RW RW 


























PRRR is not accessible when the Long-descriptor translation table format is in use. 
See, instead, 4.5.65 Memory Attribute Indirection Registers 0 and I on page 4-307. 


PRRR(NS) is architecturally mapped to AArch64 register MAIR_EL1[31:0] when 
TTBCR.EAE is 0. 


PRRR(S) is mapped to AArch64 register MAIR_EL3[31:0] when TTBCR.EAE is 0. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


PRRR is a 32-bit register when TTBCR.EAE==0. 


The following figure shows the PRRR bit assignments. 


31 30 29 28 27 26 25 24 23 


20191817161514131211109 8 76543 2 1 0 





L bso 
DS1 


| | noso Nst_| 
NOS1 NSO 


NOS2 


È 





NOS3 


Figure 4-134 PRRR bit assignments 


The following table shows the PRRR bit assignments. 


Table 4-248 PRRR bit assignments 





Bits Name | Function 





[24+n]>" | NOSn 


(2] 
1 


Outer Shareable property mapping for memory attributes n, if the region is mapped as Normal Shareable. n is 
the value of the TEX[0], C and B bits concatenated. The possible values of each NOSn bit are: 


Memory region is Outer Shareable. 


Memory region is Inner Shareable. 


The value of this bit is ignored if the region is Normal or Device memory that is not Shareable. 














[23:20] 


Reserved, RES0. 











br Where n is 0-7. 
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Table 4-248 PRRR bit assignments (continued) 








Bits Name | Function 
[19] NS1 | Mapping of S = 1 attribute for Normal memory. This bit gives the mapped Shareable attribute for a region of 
memory that: 


e Is mapped as Normal memory. 
e Has the S bit set to 1. 


The possible values of the bit are: 


e Region is not Shareable. 


1 Region is Shareable. 





[18] NSO | Mapping of S = 0 attribute for Normal memory. This bit gives the mapped Shareable attribute for a region of 
memory that: 


e Is mapped as Normal memory. 
e Has the S bit set to 0. 


The possible values of the bit are the same as those given for the NS1 bit, bit[19]. 





[17] DS1 | Mapping of S = 1 attribute for Device memory. This bit gives the mapped Shareable attribute for a region of 
memory that: 

e Is mapped as Device memory. 

e Has the S bit set to 1. 





Note 


This field has no significance in the processor. 








[16] DSO | Mapping of S = 0 attribute for Device memory. This bit gives the mapped Shareable attribute for a region of 
memory that: 

e Is mapped as Device memory. 

e Has the S bit set to 0. 





Note 


This field has no significance in the processor. 








[2n+1:2n]S|TRn | Primary TEX mapping for memory attributes n. n is the value of the TEX[0], C and B bits, see Table 4-249 
Memory attributes and the n value for the PRRR field descriptions on page 4-306. This field defines the 
mapped memory type for a region with attributes n. The possible values of the field are: 


@bee Device (nGnRnE). 

@be1 Device (not nGnRnE). 

@b128 Normal Memory. 

@b11 Reserved, effect is UNPREDICTABLE. 

















The following table shows the mapping between the memory region attributes and the n value used in the 
PRRR.nOSn and PRRR.TRz2 field descriptions. 





bs Where n is 0-7. 
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Table 4-249 Memory attributes and the n value for the PRRR field descriptions 






































Attributes n value 
TEX[0] | C 

0 0 0 

0 0 1 

0 1 2 

0 1 3 

1 0 4 

1 0 5 

1 1 6 

1 1 7 














Large physical address translations use Long-descriptor translation table formats and MAIRO replaces 


the PRRR, and MAIR1 replaces the NMRR. For more information see 4.5.65 Memory Attribute 


Indirection Registers 0 and 1 on page 4-307. 
To access the PRRR: 


MRC p15, ©, <Rt>, c10, c2, @ 5 Read PRRR into Rt 
MCR p15, ©, <Rt>, c10, c2, @ 3 Write Rt to PRRR 
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4.5.65 Memory Attribute Indirection Registers 0 and 1 
The MAIRO and MAIRI characteristics are: 


Purpose 


Usage 
constraints 


Configurations 


Attributes 


To provide the memory attribute encodings corresponding to the possible AttrIndx 
values in a Long-descriptor format translation table entry for stage | translations. 


These registers are accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. [Rw {Rw IRW [RW RW 


























Accessible only when using the Long-descriptor translation table format. When using 
the Short-descriptor format see, instead, 4.5.64 Primary Region Remap Register 
on page 4-304 and 4.5.66 Normal Memory Remap Register on page 4-309. 


AttrIndx[2], from the translation table descriptor, selects the appropriate MAIR: 
setting AttrIndx[2] to 0 selects MAIRO. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


The Secure instance of the register gives the value for memory accesses from Secure 
state. 


The Non-secure instance of the register gives the value for memory accesses from 
Non-secure states other than Hyp mode. 


MAIRO(NS) is architecturally mapped to AArch64 register MAIR_EL1[31:0] when 
TTBCR.EAE==1. See 4.3.75 Memory Attribute Indirection Register, EL1 
on page 4-175. 


MAIRO(S) is mapped to AArch64 register MAIR_EL3[31:0] when TTBCR.EAE==1. 
See 4.3.77 Memory Attribute Indirection Register, EL3 on page 4-177. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


MAIRO has write access to the Secure instance of the register disabled when the 
CP1I5SDISABLE signal is asserted HIGH. 


MAIRO is a 32-bit register when TTBCR.EAE==1. 


The following figure shows the MAIRO and MAIRI bit assignments. 


31 


24 23 16 15 8 7 0 





MAIRO Attr3 Attr2 Attr1 AttrO 
MAIR1 Attr7 Attr6 Attr5 Attr4 


Figure 4-135 MAIRO and MAIR1 bit assignments 


The following table shows the MAIRO and MAIR1 bit assignments. 
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Table 4-250 MAIRO and MAIR1 bit assignments 





Bits 


Name 


Description 





[7:0] 


Attrm>t 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long-descriptor format translation table entry, where: 











e  AttrIndx[2] selects the appropriate MAIR: 
— Setting AttrIndx[2] to 0 selects MAIRO. 
— Setting AttrIndx[2] to 1 selects MAIR1. 
e  AttrIndx[2:0] gives the value of <n> in Attr<n>. 








The following table shows the Attr<n>[7:4] bit assignments. 


Table 4-251 Attr<n>[7:4] bit assignments 





Bits 


Meaning 





ebeeee 


Device memory. See The following table for the type of Device memory. 





@bEORW, RW not 0O 


Normal Memory, Outer Write-through transient." 





0be100 


Normal Memory, Outer Non-Cacheable. 





@bO1RW, RW not 00 


Normal Memory, Outer Write-back transient. 





@b10RW 


Normal Memory, Outer Write-through non-transient. 





@b11RW 

















Normal Memory, Outer Write-back non-transient. 








The following table shows the Attr<n>[3:0] bit assignments. The encoding of Attr<n>[3:0] depends on 
the value of Attr<n>[7:4], as the following table shows. 


Table 4-252 Attr<n>[3:0] bit assignments 





Bits 


Meaning when Attr<n>[7:4] is 0000 


Meaning when Attr<n>[7:4] is not 0000 





e@beeee 


Device-nGnRnE memory 


UNPREDICTABLE 





ObOORW, RW not 0O 


UNPREDICTABLE 


T 


Normal Memory, Inner Write-through transient 





0b0100 


Device-nGnRE memory 


Normal memory, Inner Non-Cacheable 





ObOLRW, RW not 0O 


UNPREDICTABLE 


z 


Normal Memory, Inner Write-back transient 





0b1000 


Device-nGRE memory 


Normal Memory, Inner Write-through non-transient (RW=00) 





@b1ORW, RW not 00 


UNPREDICTABLE 


T 


Normal Memory, Inner Write-through non-transient 





0b1100 


Device-GRE memory 


Normal Memory, Inner Write-back non-transient (RW=00) 





Ob11RW, RW not 00 








UNPREDICTABLE 


T 














Normal Memory, Inner Write-back non-transient 








The following table shows the encoding of the R and W bits that are used, in some Attr<n> encodings in 


Table 4-251 Attr<n>[7:4] bit assignments on page 4-308 and Table 4-252 Attr<n>[3:0] bit 
assignments on page 4-308, to define the read-allocate and write-allocate policies: 





bt 
bu 


Where m is 0-7. 
The transient hint is ignored. 
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Table 4-253 Encoding of R and W bits in some Attr<n> fields 























R or W | Meaning 
0 Do not allocate 
1 Allocate 
To access the MAIRO: 
MRC p15, ©, <Rt>, c10, c2, @ 3 Read MAIRO into Rt 
MCR p15, ©, <Rt>, c10, c2, @ 3 Write Rt to MAIRO 
To access the MAIR1: 
MRC p15, ©, <Rt>, c10, c2, 1 3 Read MAIR1 into Rt 


MCR p15, @, <Rt>, c10, c2, 1 ; Write Rt to MAIR1 


Normal Memory Remap Register 


The NMRR characteristics are: 


Purpose 


Usage 
constraints 


Configurations 


Attributes 


Provides additional mapping controls for memory regions that are mapped as Normal 
memory by their entry in the PRRR. 


This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [Rw {Rw IRW [RW RW 


























The register is: 
e Used in conjunction with the PRRR. 
e Not accessible when using the Long-descriptor translation table format. 


If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


The Non-secure NMRR is architecturally mapped to the AArch64 
MAIR_EL1[63:32] register when TTBCR.EAE==0. 


The Secure NMRR is mapped to the AArch64 MAIR_EL3[63:32] register when 
TTBCR.EAE==0. 


NMRR is a 32-bit register when TTBCR.EAE==0. 


The following figure shows the NMRR bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 161514131211109 8 76543 2 1 





Figure 4-136 NMRR bit assignments 


The following table shows the NMRR bit assignments. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


4-309 
reserved. 
Non-Confidential 


4 System Control 


4.5 AArch32 register descriptions 


Table 4-254 NMRR bit assignments 








Bits Name | Description 
(2n+17:2n ORn | Outer Cacheable property mapping for memory attributes n, if the region is mapped as Normal memory by the 
+16]°Y PRRR.TRz entry. n is the value of the TEX[0], C and B bits, see Zable 4-249 Memory attributes and the n 


value for the PRRR field descriptions on page 4-306. The possible values of this field are: 


@bee 
@be1 
@b10 
@b11 


Region is Non-cacheable. 


Region is Write-Back, Write-Allocate. 


Region is Write-Through, no Write-Allocate. 


Region is Write-Back, no Write-Allocate. 





[2n+1:2n]>Y 











Inner Cacheable property mapping for memory attributes n, if the region is mapped as Normal Memory by the 
PRRR.TRz entry. n is the value of the TEX[0], C and B bits, see Zable 4-249 Memory attributes and the n 
value for the PRRR field descriptions on page 4-306. The possible values of this field are the same as those 


given for the ORz field. 








4.5.67 


4.5.68 


4.5.69 


4.5.70 


4.5.71 


To access the NMRR: 


MRC p15, ©, <Rt>, c10, c2, 1 
MCR p15, ©, <Rt>, c10, c2, 1 5 Write Rt to NMRR 


Auxiliary Memory Attribute Indirection Register 0 


3 Read NMRR into Rt 


The processor does not implement AMAIRO, so this register is always RESo. 


Auxiliary Memory Attribute Indirection Register 1 


The processor does not implement AMAIR1, so this register is always RESo. 


Hyp Auxiliary Memory Attribute Indirection Register 0 


The processor does not implement HAMAIRO, so this register is always RESO. 


Hyp Auxiliary Memory Attribute Indirection Register 1 


The processor does not implement HAMAIRI, so this register is always RESO. 


Vector Base Address Register 


The VBAR characteristics are: 


Purpose 


Usage 
constraints 





bv Where n is 0-7. 


Holds the exception base address for exceptions that are not taken to Monitor mode 
or to Hyp mode when high exception vectors are not selected. 


This register is accessible as follows: 




















ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RW |RW |RW | RW RW 














Software must program the Non-secure instance of the register with the required 
initial value as part of the processor boot sequence. 
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Configurations If EL3 is using AArch32, there are separate Secure and Non-secure instances of this 
register. 


The Non-secure VBAR is architecturally mapped to the AArch64 VBAR_EL1 
register. See 4.3.78 Vector Base Address Register, ELI on page 4-178. 


The Secure VBAR is mapped to AArch64 register VBAR_EL3[31:0]. See 
4.3.80 Vector Base Address Register, EL3 on page 4-180. 


Attributes VBAR is a 32-bit register. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


To access the VBAR: 


MRC p15, ©, <Rt>, c12, c@, @ ; Read VBAR into Rt 
MCR p15, ©, <Rt>, c12, c@, © ; Write Rt to VBAR 


4.5.72 Reset Management Register 
The RMR characteristics are: 


Purpose Controls the execution state that the processor boots into and allows request of a 
Warm reset. 


Usage constraints This register is accessible as follows: 








ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
z e = 7 - RW RW 


























Configurations The RMR is architecturally mapped to the AArch64 RMR_EL3 register. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes RMR is a 32-bit register. 
The following figure shows the RMR bit assignments. 
31 210 


mT 
RR— 
AA64 
Figure 4-137 RMR bit assignments 


The following table shows the RMR bit assignments. 
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Table 4-255 RMR bit assignments 





Bits 


Name | Function 





[31:2] 


- Reserved, RESO. 





[1] 


RR Reset Request. The possible values are: 


(2) This is the reset value. 


The bit is strictly a request. 
The RR bit drives the WARMRSTREQ output signal. 


1 Requests a Warm reset. This bit is set to 0 by either a cold or Warm reset. 


















































[0] AA64 | Determines which execution state the processor boots into after a Warm reset. The possible values are: 
7) AArch32 Execution state. 
1 AArch64 Execution state. 
The Cold reset value depends on the AA64nAA3?2 signal. 
To access the RMR: 
MRC p15,0,<Rt>,c12,c@,2 ; Read RMR into Rt 
MCR p15,0,<Rt>,c12,c@,2 ; Write Rt to RMR 
Register access is encoded as follows: 
Table 4-256 RMR access encoding 
coproc | opc1 | CRn | CRm | opc2 
1111 000 1100 | 0000 | 010 
4.5.73 Interrupt Status Register 
The ISR characteristics are: 
Purpose Shows whether an IRQ, FIQ, or external abort is pending. An indicated pending 
abort might be a physical abort or a virtual abort. 
Usage This register is accessible as follows: 
constraints 
ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO [RO |RO |RO RO 


























Configurations ISR is architecturally mapped to AArch64 register ISR_EL1. See 4.3.83 Interrupt 


Status Register on page 4-182. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes ISR is a 32-bit register. 


The following figure shows the ISR bit assignments. 


31 


98765 


me 


Figure 4-138 ISR bit assignments 


0 
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The following table shows the ISR bit assignments. 


Table 4-257 ISR bit assignments 




















Bits | Name | Function 

[31:9] | - Reserved, RESO. 

[8] A External abort pending bit: 
i) No pending external abort. 
1 An external abort is pending. 

[7] I IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
(2 No pending IRQ. 
1 An IRQ interrupt is pending. 

[6] F FIQ pending bit. Indicates whether an FIQ interrupt is pending: 
2) No pending FIQ. 
1 An FIQ interrupt is pending. 

[5:0] |- Reserved, RESO. 

















To access the ISR: 


MRC p15, ©, <Rt>, c12, c1, 1; Read ISR into Rt 
Register access is encoded as follows: 


Table 4-258 ISR access encoding 





coproc | opc1 | CRn | CRm | opc2 




















1111 000 |1100 |0001 |000 





4.5.74 Hyp Vector Base Address Register 
The HVBAR characteristics are: 


Purpose Holds the exception base address for any exception that is taken to Hyp mode. 


Usage constraints This register is accessible as follows: 








ELO | ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |. |. |. [Rw RW : 


























Configurations The HVBAR is: 
e Architecturally mapped to the AArch64 VBAR_EL2[31:0]. See 4.3.79 Vector 
Base Address Register, EL2 on page 4-179. 


Attributes HVBAR is a 32-bit register. 


The following figure shows the HVBAR bit assignments. 
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The following table shows the HVBAR bit assignments. 


Bits |Name Function 


4 


System Control 


4.5 AArch32 register descriptions 


5 


4 0 


Vector Base Address 


Figure 4-139 HVBAR bit assignments 


Table 4-259 HVBAR bit assignments 





[31:5] | Vector Base Address | Bits[31:5] of the base address of the exception vectors, for exceptions taken in this exception level. 
Bits[4:0] of an exception vector are the exception offset. 





[4:0] 








Reserved, RESO. 








To access the HVBAR: 


MRC p15, 4, <Rt>, c12, c@, @ ; Read HVBAR into Rt 
MCR p15, 4, <Rt>, c12, c@0, © ; Write Rt to HVBAR 


4.5.75 FCSE Process ID Register 


The processor does not implement Fast Context Switch Extension (FCSE), so this register is always RESO. 


4.5.76 Extended Control Register 
The ECTLR characteristics are: 


Provides configuration and control options for the L1 and L2 memory systems. 


Purpose 


Usage 
constraints 


Configurations 


Attributes 


This register is accessible as follows: 




















ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- {RW [RW [RW [RW RW 











The ECTLR: 


e This register is write accessible in EL1 if ACTLR_S.ECTLR_EN is 1 and 
HACTLR.ECTLR_EN is 1, or ACTLR_S.ECTLR_EN is 1 and SCR.NS is @. 
e If write access not possible, then trap to the lowest exception level that denied 


access (EL2 or EL3). 


The ECTLR is mapped to the AArch64 ECTLR_ELI register. See 4.3.84 Extended 
Control Register, ELI on page 4-183. 


ECTLR is a 32-bit register. 


The following figure shows the ECTLR bit assignments. 
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31 11109 87 6 5 3 2 0 
MMUPF ——! 
STXEN 
L2FP 
L1FP 
SMPEN 
CPURETCTL 


Figure 4-140 ECTLR bit assignments 
The following table shows the ECTLR bit assignments. 


Table 4-260 ECTLR bit assignments 





Bits Name Function 





[31:11] Reserved, RESO. 





[10] MMUPF Enables MMU prefetch. The reset value is @b1. 





[9] STXEN Enables exclusive signaling on the ACE master interface for CleanUnique requests due to cacheable 
Exclusive stores. 


The reset value is 0. 











[8] L2PF Enable L2 prefetch requests sent by the stride prefetcher. The reset value is 0b1. 
[7] LIPF Enable L1 prefetch requests sent by the stride prefetcher. The reset value is 0b1. 
[6] SMPEN Enable hardware management of data coherency with other cores in the cluster. The possible values are: 


© Disables data coherency with other cores in the cluster. This is the reset value. 


1 Enables data coherency with other cores in the cluster. 





Note 


Set the SMPEN bit before enabling the caches, even if there is only one core in the system. 








[5:3] l- Reserved, RESO. 





[2:0] CPURETCTL | CPU retention control. The possible values are: 

















ebeee Disable the retention circuit. This is the reset value. 
@bee1 2 Architectural Timer ticks are required before retention entry. 
@be10 8 Architectural Timer ticks are required before retention entry. 
@be11 32 Architectural Timer ticks are required before retention entry. 
@b100 64 Architectural Timer ticks are required before retention entry. 
@b101 128 Architectural Timer ticks are required before retention entry. 
@b110 256 Architectural Timer ticks are required before retention entry. 
@b111 512 Architectural Timer ticks are required before retention entry. 
To access the ECTLR: 


MRRC p15,1,<Rt>,<Rt2>,c15; Read ECTLR_EL1 into Rt 
MCRR p15,1,<Rt>,<Rt2>,c15; Write Rt to ECTLR_EL1 
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or: 


MRC p15,1,<Rt>,c15,c2,1 ; Read ECTLR[31:0] into Rt 
MCR p15,1,<Rt>,c15,c2,1 ; Write Rt to ECTLR[31:0] 


4.5.77 L2 Memory Error Syndrome Register 
The L2ZMERRSR characteristics are: 


Purpose Holds ECC errors on the: 
e L2 data RAMs. 
e L2 tag RAMs. 
e SCU snoop filter RAMs. 





Usage This register is accessible as follows: 
constraints 
ELO | ELO|EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 





- - RW |RW |RW | RW RW 


























Configurations The L2MERRSR is: 

e Architecturally mapped to the AArch64 LZMERRSR_ ELI register. See 4.3.85 L2 
Memory Error Syndrome Register on page 4-185. 

e There is one copy of this register that is used in both Secure and Non-secure 
states. 

e A write of any value to the register updates the register to 0x10000000. 

e Accessing this register from an external debugger is not possible if EL3 is in 
AArch32 state (external debug mode). 


Attributes L2MERRSR is a a 64-bit register. 


The following figure shows the LAMERRSR bit assignments. 








63 62 46 45 4039 38 37 323130 2524 23 22 21 18 17 1615 32 0 
RESO pete eee RESO iz Way re Index = 
L— Fatal Valid — RAMID— 


Figure 4-141 L2MERRSR bit assignments 
The following table shows the L2MERRSR bit assignments. 


Table 4-261 L2MERRSR bit assignments 





Bits Name Function | 








[63] Fatal Fatal bit. This bit is set to 1 on the first memory error that caused a data abort. It is a sticky bit so that after it is 
set, it remains set until the register is written. 


The reset value is 0. 





[62:46] | - Reserved, RESO. | 





[45:40] | Other error | This field is set to 0 on the first memory error and is incremented on any memory error that does not match the 
count RAMID and Bank/Way information in this register while the sticky Valid bit is set. 


The reset value is 0. 








[39:38] 











Reserved, RESO. | 
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Table 4-261 L2MERRSR bit assignments (continued) 







































































Bits |Name Function 
[37:32] | Repeat This field is set to 0 on the first memory error and is incremented on any memory error that exactly matches the 
error count | RAMID and Bank/Way information in this register while the sticky Valid bit is set. 
The reset value is 0. 
[31] Valid Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it remains set until 
the register is written. 
The reset value is 0. 
[30:25] | - Reserved, RESO. 
[24] RAMID RAM Identifier. Indicates the RAM in which the first memory error occurred. The possible values are: 
0xð L2 tag RAM. 
0x1 L2 data RAM. 
The reset value is 0. 
[23:22] | - Reserved, RESO. 
[21:18] | Way Indicates the RAM where the first memory error occurred. The reset value is 0. 
L2 tag Ox@ Way 0 L2 data RAM @x@ Bank 0 
RAM 0x1 Way 1 0x1 Bank 1 
OxE Way 14 0x7 Bank 7 
@xF Way 15 @x8- OXF Unused 
[17:16] | - Reserved, RESO. 
[15:3] | Index Indicates the index address of the first memory error. 
The reset value is 0. 
[2:0] |- Reserved, RESO. 
Note 
e A fatal error results in the RAMID, CPU ID/Way and RAM address recording the fatal error, even if 
the sticky bit was set. 
¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 
¢ If two or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is incremented only by one. 
e Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is incremented only by one. 
To access the LIMERRSR: 
MRRC p15, 3, <Rt>, <Rt2>, c15; Read L2MERRSR into Rt and Rt2 
MCRR p15, 3, <Rt>, <Rt2>, c15; Write Rt and Rt2 to L2MERRSR 
4.5.78 Configuration Base Address Register 
The CBAR characteristics are: 
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4 System Control 
4.5 AArch32 register descriptions 


Purpose 

Holds the physical base address of the memory-mapped GIC CPU interface registers. 
Usage constraints 

This register is accessible as follows: 























ELO | EL1 | EL2 
- RO |RO 
Configurations 
This register is available in all build configurations. 
Attributes 
CBAR is a 32-bit register. 
The following figure shows the CBAR bit assignments. 
31 18 17 8 7 0 


PERIPHBASE[31:18] PERIPHBASE[39:32] 


Figure 4-142 CBAR bit assignments 
The following table shows the CBAR bit assignments. 


Table 4-262 CBAR bit assignments 





Bits Name Function 





[31:18] | PERIPHBASE[3 1:18] | The input PERIPHBASE[31:18] determines the reset value. 





[17:8] |- Reserved, RESO. 





[7:0] PERIPHBASE[39:32] | The input PERIPHBASE[39:32] determines the reset value. 

















To access the CBAR: 


MRC p15, 1, <Rt>, c15, c3, @; Read CBAR into Rt 


4.5.79 DCCIALL Clean Invalidate All 
The DCCIALL characteristics are: 








Purpose Cleans and invalidates all data caches or unified caches. 
Usage constraints This operation can be performed at the following exception levels: 
ELO ELO EL1 EL1 EL2 EL3 EL3 
(NS) (S) (NS) (S) (SCR.NS |(SCR.NS 
= 1) = 0) 
- WO WO WO WO WO 


























Configurations © DCCIALL performs the same function as AArch64 operation DC CIALL. 
Attributes DCCIALL is a 32-bit system operation. 


The following figure shows the DCCIALL input value bit assignments. 
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4 System Control 
4.5 AArch32 register descriptions 


31 4321 0 


Figure 4-143 DCCIALL input value bit assignments 
The DCCIALL input value bit assignments are:. 


Table 4-263 DCCIALL bit assignments 











Bits Name Function 
[31:4] - Reserved, RESO. 
[3:1] Level Cache level to operate on, minus 1. For 


example, this field is 0 for operations on L1 
cache, or 1 for operations on L2 cache. 











[0] - Reserved, RESO. 








To perform the DCCIALL operation: 


MCR p15,1,<Rt>,c15,c14,@ ; DCCIALL operation 
The operation is encoded as follows: 


Table 4-264 DCCIALL access encoding 





coproc | opc1 | CRn | CRm | opc2 





1111 001 | 1111 | 1110 | 000 
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Chapter 5 
Memory Management Unit 


This chapter describes the Memory Management Unit (MMU). 


It contains the following sections: 

e 5.1 About the MMU on page 5-321. 

e 5.2 TLB organization on page 5-322. 

e 5.3 TLB match process on page 5-323. 

e 5.4 Memory access sequence on page 5-324. 
« 5.5 MMU aborts on page 5-326. 
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5 Memory Management Unit 
5.1 About the MMU 


5.1 About the MMU 


The MMU controls address translation, access permissions, and memory attribute determination and 
checking, for memory accesses made by the Cortex-A73 processor. The address translation process maps 
the Virtual Addresses (VAs) used by the processor onto the Physical Addresses (PAs) of the physical 
memory system. These translations are defined independently for different Exception levels and Security 
states. Each enabled stage of address translation uses a set of address translations and associated memory 
properties held in memory mapped tables called translation tables. Translation table entries can be 
cached into a Translation Lookaside Buffer (TLB). 


The MMU in each core includes the following: 


e 32 entries fully-associative instruction micro TLB. 
e 48 entries fully-associative data micro TLB. 
e A main TLB consisting of two cache RAMs, one with 1024 entries and the other with 128 entries. 
— The TLB entries contain either one or both of a global indicator and an Address Space Identifier 
(ASID) to permit context switches without requiring the TLB to be invalidated. 
— The TLB entries contain a Virtual Machine Identifier (VMID) to permit virtual machine switches 
by the hypervisor without requiring the TLB to be invalidated. 
e A page table prefetcher that detects access to contiguous page tables and prefetches the next one. This 
prefetcher can be disabled in ECTLR register. 


The Cortex-A73 processor is an ARMv8 compliant processor that supports execution in both the 
AArch64 and AArch32 states. In AArch32 state, the ARMv8 address translation system resembles the 
ARMv7 address translation system with LPAE and Virtualization Extensions. In AArch64 state, the 
ARMvV8 address translation system resembles an extension to the Long-descriptor format address 
translation system to support the expanded virtual and physical address space. For more information 
regarding the address translation formats, see the ARM® Architecture Reference Manual ARMV8, for 
ARMv8-A architecture profile. Key differences between the AArch64 and AArch32 address translation 
systems are that the AArch64 state provides: 
e A translation granule of 4KB, 16KB, or 64KB for LPAE. AArch32 supports both VMSA and LPAE 
and the translation granule is limited to 4KB. 
¢ A 16-bit ASID. In AArch32, the ASID is limited to an 8-bit value. 


In AArch32 state, the only supported physical address size is 40 bits. 


The AArch64 state supports a maximum of 40-bit physical addresses. This means that any configuration 
of TCR_ELx.IPS over 40 bits is considered as 40 bits. 


You can enable or disable each stage of the address translation, independently. 


If stage 2 address translations are enabled, the initial stage 2 lookup begins at the next translation level 
and therefore the software must use concatenated page tables at the next translation level. See the ARM” 
Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile for more information on 
concatenated translation tables. 
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5 Memory Management Unit 
5.2 TLB organization 


5.2 TLB organization 


This section contains the following subsections: 
e 5.2.1 Instruction micro TLB on page 5-322. 
e 5.2.2 Data micro TLB on page 5-322. 

e 5.2.3 Main TLB on page 5-322. 


5.2.1 Instruction micro TLB 


The instruction micro TLB is implemented as a 32 entry fully-associative structure. This TLB caches 
entries at the 4KB, 16KB, 64KB, and 1MB granularity of Virtual Address (VA) to Physical Address (PA) 
mapping only. 


A hit in the instruction micro TLB provides a single CLK cycle access to the translation, and returns the 
physical address to the instruction cache for comparison. It also checks the access permissions to signal a 
Prefetch Abort. 


5.2.2 Data micro TLB 


The data micro TLB is a 48 entry fully-associative TLB that is used for data loads and stores. The cache 
entries have 4KB, 16KB, 64KB, and 1 MB granularity of VA to PA mappings only. 


A hit in the data micro TLB provides a single CLK cycle access to the translation, and returns the 
physical address to the data cache for comparison. It also checks the access permissions to signal a Data 
Abort. 


5.2.3 Main TLB 


Misses from the instruction and data micro TLBs are handled by a main TLB which contains two cache 
RAMs accessed in parallel: 


e A 4-way, set-associative, 1024 entry cache which stores VA to PA mappings for 4KB, 16KB, and 
64KB page sizes. 
e <A 2-way, set-associative, 128 entry cache which stores: 
— VA to PA mappings for 1MB, 2MB, 16MB, 32MB, 512MB, and 1GB block sizes. 
— Intermediate Physical Address (IPA) to PA mappings for 2MB (in a 4KB translation granule and 
in AArch32), 16MB (in a 16K translation granule), and 512MB (in a 64K granule) block sizes. 
Only Non-secure EL1 and ELO stage 2 translations are cached. 
— Intermediate PAs obtained during a table walk. 


Accesses to the main TLB take a variable number of cycles, based on: 


e Competing requests from each of the micro TLBs. 
¢ The TLB maintenance operations in flight. 
¢ The different page or block size mappings in use. 
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5 Memory Management Unit 
5.3 TLB match process 


5.3 TLB match process 


The ARMv8-A architecture provides for multiple maps from the VA space that are translated differently. 


The TLB entries store all the required context information to facilitate a match and avoid the requirement 
for a TLB flush on a context or virtual machine switch. Each TLB entry contains a VA, block size, PA, 
and a set of memory properties that include the memory type and access permissions. Each entry is 
associated with a particular ASID, or is global for all application spaces. The TLB entry also contains a 
field to store the VMID in the entry, applicable to accesses made from the Non-secure ELO and EL1 
Exception levels. There is also a memory space identifier that records whether the request occurred at: 


EL3, if EL3 is executing in AArch64 state. 

Non-secure EL2. 

Secure ELO or EL1, and EL3 when EL3 is executing in AArch32 state. 
Non-secure ELO or ELI. 


A TLB entry match occurs when the following conditions are met: 


Its VA, moderated by the page size such as the VA bits[47:N], where N is log» of the block size for 
that translation stored in the TLB entry, matches that of the requested address. 

The memory space matches the memory space state of the requests. 

The ASID matches the current ASID held in the CONTEXTIDR, TTBRO, or TTBR1 register or the 
entry is marked global. 

The VMID matches the current VMID held in the VTTBR register. 


Note 





The ASID and VMID matches are ignored for a request originating from EL2 or AArch64 EL3. 
The VMID match is ignored for a request not originating from Non-secure ELO or EL1. 


Lookups in TLB are only performed on block size already present for this translation regime in main 
TLB. 
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5 Memory Management Unit 
5.4 Memory access sequence 


5.4 Memory access sequence 
When the core generates a memory access, the MMU: 


1. Performs a lookup for the requested VA, current ASID, current VMID, and memory space in the 
relevant instruction or data micro TLB. 

2. Performs a lookup for the requested VA, current ASID, current VMID, and memory space in the 
main TLB if there is a miss in the relevant micro TLB. 

3. Performs a hardware translation table walk if there is a miss in the main TLB. 


When executing in AArch64 state at a particular Exception level, you can configure the hardware 
translation table walk to use either the 4KB, 16KB, or 64KB translation granule. Program the Translation 
Granule bit, TGO, in the appropriate translation control register: 





e TCR ELl. 

e TCR_EL2. 

e TCR EL3. 

e VTCR_EL2. 
Note 


For TCR_EL1 you can program the Translation Granule bits TGO and TG1 to configure the translation 
granule respectively for TTBRO_EL1 and TTBR1_ELl1. 





When executing in AArch32 state in a particular mode, you can configure the MMU to perform 
hardware translation table walks using either the Short-descriptor translation table format, or the Long- 
descriptor translation table format. This is controlled by programming the Extended Address Enable 
(EAE) bit in the appropriate Secure or Non-secure Translation Table Base Control Register (TTBCR). 
See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information on translation table formats. 





Note 


Translations in Hyp mode are always performed with the Long-descriptor translation table format. 





You can configure the MMU to perform translation table walks in Cacheable regions, by programming 
the IRGN bits in the: 


AArch32 ¢ Translation table base registers (TTBRO/TTBR1_ELx) when using the Short-descriptor 
translation table format. 
e TCR Elx register when using the Long-descriptor translation table format. 


AArch64 Appropriate TCR_ELx register. 


For stage 2 translations, the IRGN bits must be programmed in the VTCR_EL2 register. 


If the encoding of both the ORGN and IRGN bits is Write-Back, the data cache lookup is performed and 
data is read from the data cache. If the ORGN and IRGN bit contain different attributes or if the 
encoding of the ORGN and IRGN bits is Write-Through or Non-cacheable, an access to external memory 
is performed. 


In the case of a main TLB miss, the hardware does a translation table walk provided the MMU is 
enabled, and the translation using the base register has not been disabled. See the ARM® Architecture 
Reference Manual ARMV8, for ARMvS-A architecture profile for more information. 
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5 Memory Management Unit 
5.4 Memory access sequence 


If the translation table walk is disabled for a particular base register, the core returns a Translation Fault. 

If the TLB finds a matching entry, it uses the information in the entry as follows: 

e The access permission bits and the domain determine if the access is permitted. If the matching entry 
does not pass the permission checks, the MMU signals a Permission fault. See the ARM® Architecture 
Reference Manual ARMv8, ARMVv8-A architecture profile for: 

— A description of the various faults. 

— The fault codes. 

— Information regarding the registers where the fault codes are set. 
Note 


In AArch32 VMSA Short-descriptor format, the permission check includes the domain properties. 





¢ The memory region attributes specified in the TLB entry determine if the access is: 
— Secure or Non-secure. 
— Inner or Outer. 
— Normal Memory or Device type, Strongly-ordered or Device type when using the Short- 
descriptor format in AArch32 state. 
— One of the four different device memory types defined for ARMv8: 
Device-nGnRnE Device non-Gathering, non-Reordering, No Early Write Acknowledgment. 
Device-nGnRE Device non-Gathering, non-Reordering, Early Write Acknowledgment. 
Device-nGRE Device non-Gathering, Reordering, Early Write Acknowledgment. 
Device-GRE Device Gathering, Reordering, Early Write Acknowledgment. 
¢ The TLB translates the VA to a PA for the memory access. 
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5 Memory Management Unit 
5.5 MMU aborts 


5.5 MMU aborts 
Certain faults and aborts can cause an exception to be taken because of a memory access. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about aborts. 


5.5.1 External aborts 


External aborts are defined as those that occur in the memory system rather than those that the MMU 
detects. Normally, external memory aborts are rare. External aborts are caused by errors flagged to the 
ACE interface. 


When an external abort occurs on an access for a translation table walk access, the MMU returns a 
synchronous external abort. For a load multiple or store multiple operation, the address captured in the 
fault address register is that of the address that generated the synchronous external abort. 


See 4.3.49 Secure Configuration Register on page 4-139, 4.5.31 Secure Configuration Register 
on page 4-252, or the ARM” Architecture Reference Manual ARMvé, for ARMv8-A architecture profile, 
for more information. 


5.5.2 Mis-programming Contiguous Hints 


In the case of a mis-programming contiguous hint, when there is a descriptor that contains a set CH bit, 
all contiguous VAs contained in this block should be included in the input VA address space defined for 
stage 1 by TxSZ for TTBx or for stage 2 by {SLO, TOSZ}. 


The Cortex-A73 processor treats such a block, that might be a block within a contiguous set of blocks, as 
causing a Translation fault, even though the block is valid, and the address accessed within that block is 
within the size of the input address supported at a stage of translation. For more information, see the 
ARM” Architecture Reference Manual ARMvV6, for ARMv8-A architecture profile. 
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Chapter 6 
Level 1 Memory System 


This chapter describes the Level 1 (L1) memory system. 


It contains the following sections: 

¢ 6.1 About the LI memory system on page 6-328. 

e 6.2 Cache behavior on page 6-329. 

e 6.3 Support for v8 memory types on page 6-330. 

e 6.4 L1 instruction memory system on page 6-331. 

e 6.5 L] data memory system on page 6-333. 

e 6.6 Memory prefetching on page 6-336. 

¢ 6.7 Direct access to internal memory on page 6-337. 
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6 Level 1 Memory System 
6.1 About the L1 memory system 


6.1 About the L1 memory system 


The L1 memory system consists of separate instruction and data caches. The size of the instruction cache 
is 64KB. The size of the data cache is configurable to either 32KB or 64KB. 


The L1 instruction memory system has the following key features: 


Virtually Indexed, Physically Tagged (VIPT), four-way set-associative instruction cache. 
Note 


In the L1 instruction memory subsystems, aliases are not handled in hardware. 








Fixed cache line length of 64 bytes. 
Pseudo-random cache replacement policy. 
128-bit read interface from the L2 memory system. 


The L1 data memory system has the following features: 


VIPT, four-way set associative L1 data cache. 
Note 
In the L1 data memory subsystems, aliases are handled in hardware and from the programmer's point 


of view, the data cache behaves like an eight-way set associative PIPT cache (for 32KB 
configurations) and a 16-way set associative PIPT cache (for 64KB configurations). 








Fixed cache line length of 64 bytes. 

Pseudo-random cache replacement policy. 

256-bit write interface to the L2 memory system. 

128-bit read interface from the L2 memory system. 

Two 64-bit read paths from the data L1 memory system to the datapath. 
64-bit write path from the datapath to the L1 memory system. 
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6 Level 1 Memory System 
6.2 Cache behavior 


6.2 Cache behavior 


The implementation-specific features of the instruction and data caches include: 


At reset the instruction and data caches are disabled. 
Both caches are automatically invalidated immediately after reset. 
Note 
When set HIGH, the DBGLIRSTDISABLE input signal disables the automatic hardware controlled 


invalidation of the L1 data cache after the processor is reset, using nCORERESET or 
nCPUPORESET. 








You can enable or disable each L1 (instruction or data) caches independently, but you cannot disable 
the L2 unified cache and L1 caches independently because they are controlled by the same enable 
bits. See 4.5.28 System Control Register on page 4-246. 

Cache lockdown is not supported. 

On a cache miss, data for the cache linefill is requested in critical word-first order. 
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6 Level 1 Memory System 
6.3 Support for v8 memory types 


6.3 Support for v8 memory types 


The ARMv8-A architecture introduces several new memory types in place of the ARMv7 Device and 
Strongly-Ordered memory types. These relate to the following attributes: 


G Gathering. The capability to gather and merge requests together into a single transaction. 
R Reordering. The capability to reorder transactions. 


E Early-acknowledge. The capability to accept early acknowledge of transactions from the 
interconnect. 


The following table describes the ARMv8 memory types. 


Table 6-1 ARMv8 memory types 
































Memory type | Comment 

GRE Similar to Normal non-cacheable, but does not permit speculative accesses. 

nGRE Treated as nGnRE inside the Cortex-A73 processor, but can be reordered by the external interconnect. 

nGnRE Corresponds to Device in ARMv7. 

nGnRnE Corresponds to Strongly-Ordered in ARMv/7. Treated the same as nGnRE inside a Cortex-A73 processor, but 

reported differently on AxCACHE. 

As defined by the architecture, these bits apply only when the translation table is marked as ARMv8 
Device memory, they do not apply to Normal memory. If an ARMv7 architecture operating system runs 
on a Cortex-A73 processor, the Device memory type matches the nGnRE encoding and the Strongly- 
Ordered memory type matches the nGnRnE memory type. 
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6 Level 1 Memory System 
6.4 L1 instruction memory system 


6.4 L1 instruction memory system 


The L1 instruction side memory system is responsible for providing an instruction stream to the core. To 
increase overall performance and to reduce power consumption, it contains the following functionality: 


e Branch prediction. 
e Instruction caching. 


This section contains the following subsections: 

¢ 6.4.1 Instruction cache disabled behavior on page 6-331. 

¢ 6.4.2 Instruction cache speculative memory accesses on page 6-331. 
e 6.4.3 Program flow prediction on page 6-331. 


6.4.1 Instruction cache disabled behavior 


If the instruction cache is disabled, fetches cannot access any of the instruction cache arrays. An 
exception to this rule is the CP15 instruction cache operations. If the instruction cache is disabled, the 
instruction cache maintenance operations can still execute normally. 


If the instruction cache is disabled, all instruction fetches to cacheable memory are treated as if they were 
non-cacheable. This means that instruction fetches might not be coherent with caches in other cores, and 
software must take account of this. 


6.4.2 Instruction cache speculative memory accesses 


Because there can be several unresolved branches in the pipeline, instruction fetches are speculative, 
meaning there is no guarantee that they are executed. A branch or exceptional instruction in the code 
stream can cause a pipeline flush, discarding the currently fetched instructions. Because of the aggressive 
prefetching behavior, you must not place read-sensitive devices in the same page as code. Pages with 
Device memory type attributes are treated as Non-Cacheable Normal Memory when accessed by 
instruction fetches. You must mark pages that contain read-sensitive devices with the translation table 
descriptor Execute Never (XN) attribute bit. To avoid speculative fetches to read-sensitive devices when 
address translation is disabled, these devices and code that are fetched must be separated in the physical 
memory map. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


6.4.3 Program flow prediction 
The Cortex-A73 processor contains program flow prediction hardware, also known as branch prediction. 


Branch prediction increases overall performance and reduces power consumption. With program flow 
prediction disabled, all taken branches incur a penalty associated with flushing the pipeline. 


To avoid this penalty, the branch prediction hardware predicts if a branch is to be taken. For conditional 
branches, the hardware predicts if the branch is to be taken as well as the address that the branch is to go 
to, known as the branch target address. For unconditional branches, only the target is predicted. 


The hardware contains the following functionality: 

e A BTAC holding the branch target address of previously taken branches. 
e Dynamic branch predictor history stored in RAMs. 

¢ The return stack, a stack of nested subroutine return addresses. 

e A static branch predictor. 

e An indirect branch predictor. 


Predicted and non-predicted instructions 


As a general rule, the flow prediction hardware predicts all branch instructions regardless of the 
addressing mode, including: 
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6 Level 1 Memory System 
6.4 L1 instruction memory system 


e Conditional branches. 

e Unconditional branches. 

e Indirect branches associated with procedure call and return instructions. 
e Immediate branches, which are predicted by static prediction and BTAC. 
e Branches that switch between A32 and T32 states. 


Unless otherwise specified, this list applies to A64, A32, and T32 instructions. 


However, some branch instructions are not predicted: 

e Instructions with the S suffix are not predicted because they are typically used to return from 
exceptions and have side-effects that can change privilege mode and security state. 

e All mode-changing instructions. 


T32 state conditional branches 


A T32 instruction set branch that is normally encoded as unconditional can be made conditional by 
inclusion in an /f-Then (IT) block. Then it is treated as a conditional branch. 


Return stack predictions 


The return stack stores the address and, in AArch32, the A32 or T32 instruction set of the instruction 
after a procedure call type branch instruction. This address is equal to the link register value stored in r14 
in AArch32 state or X30 in AArch64 state. The following instructions cause a return stack push if 
predicted: 


e BL 

° BLX (immediate) in AArch3?2 state. 
e BLX (register) in AArch32 state. 

° BLR in AArch6é4 state. 


In AArch32 state, the following instructions cause a return stack pop if predicted: 
° BX r14 

e LDR pc, [r13], #imm 

e LDM r13, {..,pc} 

e LDM r13, {..,pc}! 

e MOV ps, r14 

e POP {...,pc} 


In AArch64 state, the RET instruction causes a return stack pop. 


Because return-from-exception instructions can change Exception level, they are not predicted. This 


includes: 

e LDM (exception return) 
e RFE 

e SUBS pc, 1r 

e  ERET 


Enabling program flow prediction 


Program flow prediction is always enabled when the MMU is enabled by setting the M bit in the relevant 
system control register (SCTLR_ELn or SCTLR) to 1. 
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6.5 


6.5.1 


6.5.2 


6 Level 1 Memory System 
6.5 L1 data memory system 


L1 data memory system 


The L1 data cache is organized as a Virtually Indexed, Physically Tagged (VIPT) cache. 


Note 
In the L1 data memory subsystems, aliases are handled in hardware and from the programmer's point of 
view, the data cache behaves like an eight-way set associative PIPT cache (for 32KB configurations) and 
a 16-way set associative PIPT cache (for 64KB configurations). 








This section contains the following subsections: 

¢ 6.5.1 Data cache coherency on page 6-333. 

e 6.5.2 Data cache disabled behavior on page 6-333. 

e 6.5.3 Data cache maintenance considerations on page 6-334. 
¢ 6.5.4 Data cache zero on page 6-334. 

¢ 6.5.5 Internal exclusive monitor on page 6-334. 

e 6.5.6 ACE transactions on page 6-335. 


Data cache coherency 


The Cortex-A73 processor uses the MOESI protocol to maintain data coherency between multiple cores. 


MOESI describes the state that a shareable line in a L1 data cache can be in: 


M Modified/UniqueDirty (UD). The line is in only this cache and is dirty. 
Owned/SharedDirty (SD). The line is possibly in more than one cache and is dirty. 
Exclusive/UniqueClean (UC). The line is in only this cache and is clean. 
Shared/SharedClean (SC). The line is possibly in more than one cache and is clean. 
Invalid//nvalid (1). The line is not in this cache. 


The L1 memory subsystem stores the MOESI state of the cache line in the tag RAM. 
Note 


The names UniqueDirty, SharedDirty, UniqueClean, SharedClean, Invalid are equivalent to the AMBA 
names for the cache states. 








Data cache invalidate on reset 
The ARMv8-A architecture does not support an operation to invalidate the entire data cache. If 
this function is required in software, it must be constructed by iterating over the cache geometry 
and executing a series of individual invalidate by set/way instructions. 
Note 


The DBGLIRSTDISABLE pin must only be used in diagnostic mode as cache coherency 
cannot be ensured if the L1 cache is not invalidated on startup. 





Data cache disabled behavior 


If the data cache is disabled, load and store instructions do not access any of the L2 or L1 data cache 
arrays. An exception to this rule is the CP15 data cache operations. If the data cache is disabled, the data 
cache maintenance operations can still execute normally. 


If the data cache is disabled, all load and store instructions to cacheable memory are treated as if they 
were non-cacheable. This means that they are not coherent with the caches in this core or the caches in 
other cores, and software must take account of this. 
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6.5 L1 data memory system 


6.5.3 Data cache maintenance considerations 
DCIMVAC operations in AArch32 state are treated as DCCIMVAC. 


DC IVAC operations in AArch64 state are treated as DC CIVAC except for permission checking and 
watchpoint matching as described in the ARM® Architecture Reference Manual ARMVv8, for ARMv8-A 
architecture profile. 


In Non-secure state, DCISW operations in AArch32 state and DC ISW operations in AArch64 state 
perform both a clean and invalidate of the target set/way. The values of HCR.SWIO and 
HCR_EL2.SWIO have no effect. 


6.5.4 Data cache zero 
The ARMv8s-A architecture introduces a Data Cache Zero by Virtual Address (DC ZVA) instruction. 


In Cortex-A73, this enables a block of 64 bytes in memory, aligned to 64 bytes in size, to be set to zero. 
For more information, see the ARM® Architecture Reference Manual ARMv8, for ARMVv8-A architecture 


profile. 


6.5.5 Internal exclusive monitor 


The Cortex-A73 processor L1 memory systems have an internal exclusive monitor. This is a two-state, 
open and exclusive, state machine that manages Load-Exclusive or Store-Exclusive accesses and Clear- 
Exclusive (CLREX) instructions. You can use these instructions to construct semaphores, ensuring 
synchronization between different processes running on the core, and also between different cores that 
are using the same coherent memory locations for the semaphore. A Load-Exclusive instruction tags a 
small block of memory for exclusive access. The size of the tagged block is defined by CTR.ERG as 64 
bytes, one cache line. 


Note 


A load/store exclusive instruction is any one of the following: 





e In the A64 instruction set, any instruction that has a mnemonic starting with LDX, LDAX, STX, or STLX. 
e In the A32 and T32 instruction sets, any instruction that has a mnemonic starting with LDREX, STREX, 
LDAEX, or STLEX. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information about these instructions. 





Treatment of intervening STR operations 


In cases where there is an intervening store operation between an exclusive load and an exclusive store 
from the same core, the intermediate store does not produce any direct effect on the internal exclusive 
monitor. The local monitor is in the Exclusive Access state after the exclusive load, remains in the 
Exclusive Access state after the store, and returns to the Open Access state only after the exclusive store, 
a CLREX instruction, or an exception return. 


However, if the address being accessed by the exclusive code sequence is in cacheable memory, any 
eviction of the cache line containing that address clears the monitor. ARM therefore recommends that no 
load or store instructions are placed between the exclusive load and the exclusive store because these 
additional instructions can cause a cache eviction. Any data cache maintenance instruction can also clear 
the exclusive monitor and any precise abort on a load/store instruction also clears the internal exclusive 
monitor. 
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6.5.6 ACE transactions 
The following table shows the ACE transactions that each type of memory access generates. 
Table 6-2 ACE transactions 
Attributes ACE transaction 
Memory type Shareability | Domain Load Store Load exclusive | Store exclusive 
Device - System ReadNoSnoop WriteNoSnoop | ReadNoSnoop WriteNoSnoop and 
and ARLOCKM. | AWLOCKM set to 
set to HIGH HIGH 
Normal, inner Non- | Non-shared System ReadNoSnoop WriteNoSnoop | ReadNoSnoop WriteNoSnoop and 
cacheable, outer i hared and ARLOCKM | AWLOCKM set to 
Non-cacheable Y set to HIGH HIGH 
Outer-shared 
Normal, inner Non- | Non-shared System ReadNoSnoop WriteNoSnoop | ReadNoSnoop ReadNoSnoop 
heable, out f ; 
ea a RMN Inner-shared System ReadNoSnoop WriteNoSnoop | ReadNoSnoop WriteNoSnoop with 
with ARLOCKM | ARLOCKM set to 
Through, or Normal, | Outer-shared System 
; ; set to HIGH HIGH 
inner Write-Through, 
outer Write-Back, 
Write-Through or 
Non-cacheable, or 
Normal inner Write- 
Back outer Non- 
cacheable or Write- 
Through 
Normal, inner Write- | Outer-shared Outer ReadShared for | ReadUnique, ReadShared CleanUnique with 
Back, outer Write- (Inner-shared) |Shareable | Linefills initiated | CleanUnique, ARLOCKM set to 
Back (Inner by and also HIGH if 
Shareable) | Loads/PTW/L1 MakeUnique for ECTLR.STXEN bit 
prefetch/ streaming is set 
PLD.ReadClean 
for L2 prefetches 





























See the ARM® AMBA” AXI and ACE Protocol Specification AXI3, AXI4, and AXT4-Lite, ACE, and ACE- 


Lite for more information about ACE transactions. 
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6.6 Memory prefetching 
This section describes memory prefetching. 


This section contains the following subsections: 

¢ 6.6.1 Preload instructions on page 6-336. 

* 6.6.2 Data prefetching and monitoring on page 6-336. 
* 6.6.3 Non-temporal loads on page 6-336. 


6.6.1 Preload instructions 


In AArch64 state, the Cortex-A73 processor supports the PRFM (Prefetch Memory) instructions which 
signal to the memory system that memory accesses from a specified address are likely to occur in the 
near future. The memory system can respond by taking actions that are expected to reduce the latency of 
the memory access when they do occur. PRFM instructions perform a lookup in the cache, and start a 
linefill if they miss and are to a cacheable address. However, the PRFM instruction retires as soon as its 
linefill is started rather than waiting for the linefill to complete. This enables other instructions to execute 
while the linefill continues in the background. 


In AArch32 state or when present in a PRFM instruction, the memory system hint instructions PLD 
(Prefetch Data) and PLDW (Preload Data With Intent To Write), for cacheable data, perform a lookup in 
the cache and start a linefill if they miss. There are four PLD slots to allow further PLD instructions to 
execute if a preceding PLD causes a translation table walk. Any linefill started by a PLDW instruction 
causes the data to be invalidated in other cores, so that the line is ready to be written to. 


The PLI (Preload Instruction) memory system hint performs preloading in the L2 cache for cacheable 
accesses if they miss in both the L1 instruction cache and L2 cache. Instruction preloading is performed 
in the background. For more information about prefetch memory and preloading caches, see the ARM® 
Architecture Reference Manual ARMVv%, for ARMv8-A architecture profile. 


6.6.2 Data prefetching and monitoring 
The data cache implements an automatic prefetcher that monitors cache misses in the core. 


When a pattern is detected, the automatic prefetcher starts linefills in the background. The prefetcher 
recognizes a sequence of data cache misses at a fixed stride pattern that lies in 32 cache lines, plus or 
minus. Any intervening stores or loads that hit in the data cache do not interfere with the recognition of 
the cache miss pattern. Up to eight independent streams can be handled by the prefetcher. This L1 
prefetcher is coupled with a simpler L2 data prefetcher which receives hints from the L1 prefetcher. 


The ECTLR and L2CTLR registers enable you to have some control over the prefetcher: 
e The LI stride prefetcher is enabled by setting bit [7] of the ECTLR register to 1. 
¢ The L2 stride prefetcher is enabled by setting bit [8] of the ECTLR register to 1. 


Use the prefetch memory system instructions for data prefetching where short sequences or irregular 
pattern fetches are required. 





6.6.3 Non-temporal loads 
In AArch64 state, cache requests made by a non-temporal load instruction (LDNP) are treated as normal 
loads. 
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6.7 Direct access to internal memory 


The Cortex-A73 processor provides a mechanism to read the internal memory used by the L1 cache and 
TLB structures through IMPLEMENTATION DEFINED system registers. This functionality can be useful when 
investigating issues where the coherency between the data in the cache and data in system memory is 
broken. 


When the processor is executing in AArch64 state, the appropriate memory block and location are 
selected using a number of write-only registers and the data is read from read-only registers as shown in 
the following table. These operations are available only in EL3. In all other modes, executing these 
instructions results in an Undefined Instruction exception. 


Table 6-3 AArch64 registers used to access internal memory 




















Function Access _| Operation Rd Data 
Data Register 0 Read-only |MRS <Xd>, S3_3_c15_c@_@| Data 
Data Register 1 Read-only |MRS <Xd>, S3_3_c15_c@_1/ Data 
Data Register 2 Read-only |MRS <Xd>, S3_3_c15_c@_2) Data 
Data Register 3 Read-only | MRS <Xd>, S3_3_c15_c@_3/ Data 
Data Cache Tag Read Operation Register Write-only | MSR S3_3_c15_c2_0@, <Xd> | Set/Way 





Instruction Cache Tag Read Operation Register | Write-only | MSR $3_3_c15_c2_1, <Xd> | Set/Way 





Data Cache Data Read Operation Register Write-only | MSR S3_3_c15_c4_0, <Xd> | Set/Way/Offset 





Instruction Cache Data Read Operation Register | Write-only | MSR S3_3_c15_c4_1, <Xd> | Set/Way/Offset 




















TLB Data Read Operation Register Write-only | MSR S3_3_c15_c4_2, <Xd> | Index/Way 





When the core is executing in AArch32 state, the appropriate memory block and location are selected 
using a number of write-only CP15 registers and the data is read from read-only CP15 registers as shown 
in the following table. These operations are available only in EL3. In all other modes, executing the 
CP15 instruction results in an Undefined Instruction exception. 


Note 


Accessing these registers from an external debugger is only possible when EL3 is in AArch64 state. 








Table 6-4 AArch32 CP15 registers used to access internal memory 




















Function Access |CP15 operation Rd Data 
Data Register 0 Read-only | MRC p15, 3, <Rd>, c15, c@, @| Data 
Data Register 1 Read-only | MRC p15, 3, <Rd>, c15, c@, 1/ Data 
Data Register 2 Read-only | MRC p15, 3, <Rd>, c15, cO@, 2| Data 
Data Register 3 Read-only | MRC p15, 3, <Rd>, c15, c@, 3| Data 
Data Cache Tag Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c2, @| Set/Way 





Instruction Cache Tag Read Operation Register | Write-only | MCR p15, 3, <Rd>, c15, c2, 1] Set/Way 





Data Cache Data Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c4, @| Set/Way/Offset 





Instruction Cache Data Read Operation Register | Write-only | MCR p15, 3, <Rd>, c15, c4, 1| Set/Way/Offset 


























TLB Data Read Operation Register Write-only | MCR p15, 3, <Rd>, c15, c4, 2 |Index/Way 
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¢ 6.7.2 Instruction cache tag and data encoding on page 6-339. 
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6.7.1 Data cache tag and data encoding 
The Cortex-A73 processor data cache consists of an 8-way or 16-way set-associative structure. 
The number of sets in each way depends on the configured size of the cache. The encoding, set in Rd in 
the appropriate MCR instruction, used to locate the required cache data entry for tag and data memory is 
shown in the following table. It is very similar for both the tag and data RAM access. Data RAM access 
includes an additional field to locate the appropriate doubleword in the cache line. 
Table 6-5 32KB data cache tag and data location encoding 
Bit-field of Rd | Description 
[31:29] Cache way 
[28:12] Unused 
[11:6] Set index 
[5:3] Cache doubleword data offset, Data Register only 
[2:0] Unused 
Table 6-6 64KB data cache tag and data location encoding 
Bit-field of Rd | Description 
[31:28] Cache way 
[27:12] Unused 
[11:6] Set index 
[5:3] Cache doubleword data offset, Data Register only 
[2:0] Unused 
Data cache reads return 64 bits of data in Data Register 0 and Data Register 1. The tag information, 
MOESI coherency state, outer attributes, and valid, for the selected cache line is returned using Data 
Register 0 and Data Register 1 using the format shown in the following table. The core encodes the 4-bit 
MOESI coherency state across two fields of Data Register 0 and Data Register 1. 
Table 6-7 Data cache tag data format 
Register Bit-field Description 
Data Register 0 [31] Partial MOESI state, Dirty 
[30] Partial MOESI state, Exclusive 
[29] Partial MOESI state, Valid 
[28] Security state, NS 
[27:0] Tag address [39:12] 
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Table 6-7 Data cache tag data format (continued) 
































Register Bit-field Description 
Data Register 1 [31:4] Unused 

[3] Outer shareability 

[2:1] Memory hint (read/write) 

[0] Partial MOESI state, Globally shared 
6.7.2 Instruction cache tag and data encoding 


The Cortex-A73 processor instruction cache is significantly different from the data cache and this is 
shown in the encodings and data format used in the CP15 operations used to access the tag and data 
memories. The following table shows the encoding required to select a given cache line. 


Table 6-8 Instruction cache tag and data location encoding 




















Bit-field of Rd | Description 

[31:30] Cache Way 

[29:14] Unused 

[13:6] Set index 

[5:3] Cache doubleword data offset, Data Register only 
[2:0] Unused 














The following table shows the tag and valid bits format for the selected cache line using only Data 
Register 0. 


Table 6-9 Instruction cache tag data format 


Bits Description 





[31:30] | Unused 





[29] | Valid 





[28] Non-secure state (NS) 








[27:0] | Tag address 











The CP15 Instruction Cache Data Read Operation returns a 64-bit entry from the cache in Data Register 
0 and Data Register 1. 


The CP15 Instruction Cache Tag Read Operation returns two entries from the cache in Data Register 0 
and Data Register 1 corresponding to the 16-bit aligned offset in the cache line: 





Data Register 0 Bits[31:0] data from cache offset + @beee. 
Data Register 1 Bits[31:0] data from cache offset + @b100. 
In T32 state, these two fields can represent any combination of 16-bit and partial or full 32-bit 
instructions. 
6.7.3 TLB data encoding 


The main TLB is built from two cache RAMs: 
RAMO This is a 4-way set-associative RAM array for 4KB, 16KB, and 64KB page translation entries. 
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RAM1 This is a 2-way set-associative RAM array for 1MB, 2MB, 16MB, 32MB, 512MB, and 1GB 
block sizes, walk cache, and IPA cache. 
RAMO holds regular format entries. 


RAM1 holds: 

¢ TLB regular format entries. 
e TLB walk format entries. 

e TLB IPA format entries. 


The TLB walk format entry is identified by the Entry type field set to 1. 
The TLB IPA format entry is identified by the Entry type field set to @ and the S1 level field set 
to @b11. 


To read the individual entries into the data registers, software must write to the TLB Data Read 
Operation Register. The following table shows the write TLB Data Read Operation Register location 



























































encoding. 
Table 6-10 TLB Data Read Operation Register location encoding 
Bits Description 
[31:30]>” | TLB way 
[29:9] Unused 
[8] Type: 
2) RAMO. 
1 RAMI. 
[7:0] | TLB index. 
Both RAMO and RAM 1 are 117 bits wide. The data is returned in the data registers: 
Data Register 0[31:0] RAM data[31:0] 
Data Register 1[31:0] RAM data[63:32] 
Data Register 2[31:0] RAM data[95:64] 
Data Register 3[20:0] RAM data[116:96] 
TLB regular format 
The following table shows the TLB regular format encoding. 
Table 6-11 TLB regular format encoding 
Bits Name Description 
[116] Entry type Indicates the entry type: 
@ Regular page or IPA cache entry. 
1 Walk cache entry. 
[115] Outer Shareable Indicates the Outer Shareable memory 
attribute. 
bw Bit [31] is unused if bit [8] = @b1. 
bx Bits [7:6] are unused if bit [8] = @b1. 
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Table 6-11 TLB regular format encoding (continued) 
























































Bits Name Description 

[114:109] MemAttr[7:2] Indicates the memory attributes, which are 
a combination of stage 1 and stage 2 for 
this entry. (Inner read/write allocate hint 
ignored.) 

[108:107] HAP[1:0] Indicates the hypervisor access 
permissions, from stage 2 translation. 

[106:105] S2 Translation Mode Indicates the stage 2 translation mode. 
e@bee S2 off. 
@be1 LPAE 4K. 
@b10 LPAE 16K. 
@b11 LPAE 64K. 

[104] S2 Level Indicates the stage 2 translation level. 
@be Level 2. 
@b1 Level 1. 

[103] PXN Indicates the privileged execute-never 
attribute, from stage 1 translation. 

[102] ST2XN Indicates the Execute-never attribute, from 
stage 2 translation. 

[101] STIXN Indicates the Execute-never attribute, from 
stage 1 translation. 

[100:98] AP[2:0] Indicates the access permissions, from 
stage 1 translation. 

[97] Split Asserted if the stage 1 page size is larger 
than stage 2 page size. 

[96] NS Non-secure VA. 

[95:68] PA Physical address. 

[67] Valid Entry Indicates that the entry is valid: 
© Entry is not valid. 
1 Entry is valid. 

[66:34] VA[48:16] Indicates the virtual address. 

[33:26] VMID[7:0] Indicates the virtual machine identifier. 

[25:18] ASID_HI[7:0] In AArch64, indicates the most significant 
bits of the Address Space Identifier (ASID). 
In AArch32, VMSA short format bits 
[21:18] represent the domain index. 

[17:10] ASID_LO[7:0] Indicates the least significant byte of the 


ASID. 





[9] 








nG 





Indicates the Non-global bit. 
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Table 6-11 TLB regular format encoding (continued) 











Bits Name Description 
[8:6] Size Indicates the size of memory mapped by 
block or page allocated in the TLB entry: 
In TLB e@beee A4KB. 
RAMO: @bee1 16KB. 
@be10 64KB. 
In TLB e@beee IMB. 
RAMI: @bee1 2MB. 
0b010 16MB. 
b011 32MB. 
@b100 512MB. 
Qb101 1GB. 
[5:4] Translation Regime The possible values are: 
@bee In AArch64: EL0/1 NS. 
In AArch32: PLO/1 NS. 
@b@1 In AArch64: EL0/1 S. 
In AArch32: PLO/1 S. 
0b10 In AArch64: EL2 (NS). 
In AArch32: PL2 (NS). 











b11 EL3 (S). 
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Table 6-11 TLB regular format encoding (continued) 





Bits 


Name 


Description 





[3:2] 


S1 Translation Mode 


@bee 
@be1 
@b10 
@b11 


Indicates the stage 1 translation mode. 


VMSA short format. 
LPAE 4K. 

LPAE 16K. 

LPAE 64K. 





[1:0] 








S1 Level 


VMSA 


LPAE 
4k 


LPAE 
16K 


LPAE 
64K 





@bee 
@be1 
@b10 


@b11 


@bee 
@be1 
@b10 
@b11 


@bee 
@be1 
@b10 


@b11 


@bee 
@be1 
@b10 


@b11 


Indicates the stage 1 level that gave this 
translation for AArch32: 


Level 2. 
Level 1. 


Level 1 with 
contiguous hint. 


Level 2 with 
contiguous hint. 


Level 3. 
Level 2. 
Level 1. 


Level 3 with 
contiguous hint. 


Level 2. 
Level 1. 


Not used in regular 
format. 


Level 2 with 
contiguous hint. 


Level 2. 
Level 1. 


Not used in regular 
format. 


Level 2 with 
contiguous hint. 








TLB walk format 


The following table shows the encoding for a translation table walk entry. 
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Table 6-12 TLB walk format encoding 



























































Bits Name Description 

[116] Entry type Indicates the entry type: 
© Regular page or IPA cache entry. 

1 Walk cache entry. 

[115] Outer Shareable Indicates the Outer Shareable memory 
attribute. 

[114:109] MemAttr[7:2] Indicates the memory attributes, which are 
a combination of stage 1 and stage 2 for 
this entry. (Inner read/write allocate hint 
ignored.) 

[108:107] HAP[1:0] Indicates the hypervisor access 
permissions, from stage 2 translation. 

[106:105] S2 Translation Mode Indicates the stage 2 translation mode. 
e@bee S2 off. 

@be1 LPAE 4K. 
@b12 LPAE 16K. 
@b11 LPAE 64K. 

[104] S2 Level Indicates the stage 2 translation level. 
@be Level 2. 

@b1 Level 1. 

[103] PXN Indicates the privileged execute-never 
attribute, from stage 1 translation. 

[102] ST2XNTable Indicates the Execute-never attribute, from 
stage 2 translation. 

[101] ST1XNTable Indicates the Execute-never attribute, from 
stage 1 translation. 

[100:98] APTable[2:0] Indicates the access permissions, from 
stage | translation. 

[97] Split Asserted if the stage 1 page size is larger 
than stage 2 page size. 

[96] NS Non-secure VA. 

[95:68] PA Physical address. 

[67] Valid Entry Indicates that the entry is valid: 
© Entry is not valid. 

1 Entry is valid. 
[66:34] VA[48:16] Indicates the virtual address. 
[33:26] VMID[7:0] Indicates the virtual machine identifier. 
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Table 6-12 TLB walk format encoding (continued) 





Bits 


Name 


Description 





[25:18] 


ASID_HI[7:0] 


In AArch64, indicates the most significant 
bits of the Address Space Identifier (ASID). 
In AArch32 VMSA, bits [21:18] represent 
the domain index. 





ASID_LO[7:0] 


Indicates the least significant byte of the 
ASID. 





nG 


Indicates the Non-global bit. Always @. 





Size 


In this context, these bits are for the 
translation granule: 


ebeee VMSA short format. 
@be01 LPAE 4K. 

@be11 LPAE 16K. 

@b100 LPAE 64K. 





[5:4] 





Translation Regime 








The possible values are: 


@bee@ In AArch64: EL0/1 NS. 
In AArch32: PLO/1 NS. 


@be1 In AArch6é4: ELO/1 S. 
In AArch32: PLO/1 S. 


0b10 In AArch64: EL2 (NS). 
In AArch32: PL2 (NS). 


@b11 EL3 (S). 
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Table 6-12 TLB walk format encoding (continued) 





Bits Name Description 





[3:2] S1 Translation Mode Indicates the stage 1 translation mode. 


@bee VMSA short format. 
@be1 LPAE 4K. 

@b10 LPAE 16K. 

@b11 LPAE 64K. 





[1:0] S1 Level Indicates the stage 1 level that gave this 
translation for AArch32: 


VMSA @bee Level 2. 
@be1 Level 1. 


@b10 Level 1 with 
contiguous hint. 


@b11 Level 2 with 
contiguous hint. 


LPAE @bee Level 3. 
4K @be1 Level 2. 
Q@b10 Level 1. 


@b11 Level 3 with 
contiguous hint. 


LPAE Q@bee Level 2. 
16K @b@1 Level 1. 


@b1@ Not used in regular 
format. 


@b11 Level 2 with 
contiguous hint. 


LPAE @bee Level 2. 
64K @be1 Level 1. 


@b1@ Not used in regular 
format. 


@b11 Level 2 with 
contiguous hint. 

















TLB IPA format 


The following table shows the encoding for an IPA translation entry. 


Table 6-13 TLB IPA format encoding 





Bits Name Description 





[116] Entry type Indicates the entry type: 
© Regular page or IPA cache entry. 























[115] Outer Shareable Indicates the Outer Shareable memory 
attribute. 
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Table 6-13 TLB IPA format encoding (continued) 
Bits Name Description 
[114:109] MemAttr[7:2] Indicates the memory attributes, which are 
a combination of stage 1 and stage 2 for 
this entry. (Inner read/write allocate hint 
ignored.) 
[108:107] HAP[1:0] Indicates the hypervisor access 
permissions, from stage 2 translation. 
[106:105] S2 Translation Mode Indicates the stage 2 translation mode. 
e@bee S2 off. 
@be1 LPAE 4K. 
@b10 LPAE 16K. 
@b11 LPAE 64K. 
[104] S2 Level Indicates the stage 2 translation level. 
@be Level 2. 
@b1 Level 1. 
[103] PXN Not applicable. 
[102] ST2XN Indicates the Execute-never attribute, from 
stage 2 translation. 
[101] STIXN Not applicable. 
[100:98] AP[2:0] Indicates the access permissions, from 
stage 1 translation. 
[97] Split Not applicable. 
[96] NS Non-secure IPA. 
[95:68] PA Physical address. 
[67] Valid Entry Indicates that the entry is valid: 
© Entry is not valid. 
1 Entry is valid. 
[66:58] - Reserved, RESO 
[57:34] IPA[39:16] Indicates the intermediate physical address. 
[33:26] VMID[7:0] Indicates the virtual machine identifier. 
[25:18] ASID_HI[7:0] Not applicable. 
[17:10] ASID_LO[7:0] Not applicable. 
[9] nG Not applicable. 
[8:6] Size In this context, these bits are for the 
translation granule: 
e@bee1 LPAE 4K. 
@be11 LPAE 16K. 
@b10e LPAE 64K. 
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6.7 Direct access to internal memory 











Table 6-13 TLB IPA format encoding (continued) 
Bits Name Description 
[5:4] Translation Regime The possible values are: 
@bee@ In AArch64: EL0/1 NS. 
In AArch32: PLO/1 NS. 
[3:2] S1 Translation Mode Always @b@1. 





[1:0] 








S1 Level 


Always @b10. 
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Chapter 7 
Level 2 Memory System 


This chapter describes the Level 2 (L2) memory system. 


It contains the following sections: 

¢ 7.1 About the L2 memory system on page 7-350. 

e 7.2 L2 cache on page 7-351. 

e 7.3 Snoop Control Unit on page 7-352. 

¢ 7.4 ACE master interface on page 7-353. 

¢ 7.5 Additional memory attributes on page 7-356. 

e 7.6 ACP on page 7-358. 

e 7.7 External aborts and asynchronous errors on page 7-360. 
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7.1 About the L2 memory system 
The L2 memory system consists of: 


e An AMBA AX Coherency Extensions (ACE) master interface 128-bit bus. 

e An AMBA AXI4 Accelerator Coherency Port (ACP) slave interface 128-bit bus. 

e An integrated Snoop Control Unit (SCU), connecting up to four cores within a cluster which: 
— Maintains L1 data cache coherency between cores by snooping the L1 caches. 
— Holds duplicate copies of the L1 data cache tags for efficient coherency support. 
— Arbitrates requests from the cores and the ACP interface. 





Note 


The requests from the instruction cache perform coherency requests in the L1 data cache in order to 
maintain coherency between the instruction cache and the data cache. However, the requests from the 
L1 data cache do not perform coherency requests in the L1 instruction cache. 





e A tightly-integrated L2 cache with: 
— A configurable size of 256KB, 512KB, 1MB, 2MB, 4MB, or 8MB. 
— A 16-way, set-associative structure. 
— A fixed line length of 64 bytes. 
— Optional ECC protection. 
— A Physically Indexed, Physically Tagged (PIPT) cache. 
— A prefetcher. 


The L2 memory system has an asynchronous error mechanism, see 7.7 External aborts and 
asynchronous errors on page 7-360. 
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7.2.1 


7.2.2 


7 Level 2 Memory System 
7.2 L2 cache 


L2 cache 


The integrated L2 cache is the Point of Unification for the Cortex-A73 processor. It handles both 
instruction and data requests from the I-Side and D-side of each core respectively. 


Instructions are allocated to the L2 cache when fetched from the system and can be invalidated during 
maintenance operations. 


There are 48 linefill buffers and 16 eviction buffers. All buffers handle 64-byte cache lines. 


The L2 cache tags are looked up in parallel with the SCU duplicate tags. If both the L2 tag and SCU 
duplicate tag hit, the L1 cache data is used, because the L2 cache data might not be up to date if there has 
been a write since the last linefill. 


L2 cache is invalidated automatically at reset unless the LARSTDISABLE signal is set HIGH when the 
nL2RESET signal is deasserted. 


This section contains the following subsections: 
e 7.2.1 L2 ECC support on page 7-351. 
e 7.2.2 L2 cache RAM latency settings on page 7-351. 


L2 ECC support 


The L2 cache can be configured to support ECC for the tag and data RAMs. 


If implemented, Single Error Correct, Double Error Detect (SECDED) protection is offered with a 64- 

bit granularity. 

¢ Ifan error is detected, the transfer is blocked and the line is invalidated from the L2 cache. 

e Ifa single error is detected, the line is corrected and evicted to external memory if it is valid and dirty. 

e Ifa double error is detected, an asynchronous error is generated by asserting nRECCERRIRQ. 

e After error correction has completed, access is restarted and the line is read again from external 
memory. 

¢ Both single and double errors are recorded separately in the LAMERRSR, see the 4.3.85 L2 Memory 
Error Syndrome Register on page 4-185 for more information. 


L2 cache RAM latency settings 


The L2 cache controller supports a range of data and tag RAM sizes. Each RAM size might have 
different timing requirements. To ensure that the L2 cache operates correctly with the implemented data 
and tag RAMs, you must set the appropriate latency values in LZCTLR. See 4.3.7/ L2 Control Register 
on page 4-168 for more information. 


There are three latency settings which must be applied to the L2 cache data and tag RAMs: 


Setup latency 
The number of cycles that the driving signals are asserted before the L2 cache controller applies 
the rising edge of the clock to the RAM. 
Write access latency 
The time needed by the RAMs to internally compute the write control and data signals. It is the 
minimum number of cycles before the next rising clock edge is applied to the RAM, following a 
write access. The RAMs do not sample new data and control levels before this time has elapsed. 
Read access latency 
The minimum number of cycles before the next rising clock edge is applied to the RAM, 
following a read access. Read data is sampled in the last cycle. 
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7.3 Snoop Control Unit 


7.3 Snoop Control Unit 


The Cortex-A73 processor supports between one and four individual cores with L1 data cache coherency 
maintained by the SCU. 


The SCU maintains coherency between the individual data caches in the processor using ACE modified 
equivalents of MOESI state. 


The SCU contains buffers that can handle direct cache-to-cache transfers between cores without having 
to read or write any data to the L2 cache. Cache line migration enables dirty cache lines to be moved 
between cores, and there is no requirement to write back transferred cache line data to the L2 cache. 


Each core has a tag RAM that contains the state of the cache line. Rather than access these for each 
snoop request the SCU contains a set of duplicate tags that permit each coherent data request to be 
checked against the contents of the other caches in the cluster. The duplicate tags filter coherent requests 
from the system so that the cores and system can function efficiently even with a high volume of snoops 
from the system. 


When an external snoop hits in the duplicate tags a request is made to the appropriate core. 


This section contains the following subsections: 
¢ 7.3.1 Snoop and maintenance requests on page 7-352. 


7.3.1 Snoop and maintenance requests 


The SCU controls snoop and maintenance requests to the system using the external 
BROADCASTINNER, BROADCASTOUTER, BROADCASTCACHEMAINT, and 
BROADCASTCACHEMAINTPOU pins: 


e When you set the BROADCASTINNER pin to 1, the inner shareability domain extends beyond the 
Cortex-A73 processor, and Inner Shareable snoop and maintenance operations are broadcast 
externally. When you set the BROADCASTINNER pin to 0, the inner shareability domain does not 
extend beyond the Cortex-A73 processor. 

e When you set the BROADCASTOUTER pin to 1, the outer shareability domain extends beyond the 
Cortex-A73 processor, and outer shareable snoop and maintenance operations are broadcast 
externally. When you set the BROADCASTOUTER pin to 0, the outer shareability domain does not 
extend beyond the Cortex-A73 processor. 





Note 


¢ The Cortex-A73 processor does not differentiate the BROADCASTINNER and 
BROADCASTOUTER pins. It always broadcasts the cache maintenance operations externally when 
either the BROADCASTINNER or BROADCASTOUTER pins are equal to 1. That is, outer 
coherency setting is not supported. 

e Inasystem that contains Cortex-A73 processors and other processors in a big. LITTLE” 
configuration, you must ensure the BROADCASTINNER and BROADCASTOUTER pins on both 
processors are set to HIGH so that both processors are in the same Inner Shareable domain. 





* BROADCASTCACHEMAINT should always be set to 0 as the Cortex-A73 processor does not 
support broadcast of cache maintenance operations to downstream caches. 

* If BROADCASTCACHEMAINTPOU is set to 1, then the cache maintenance to the PoU is 
broadcast to other cores in the same shareability domain. If all the cores in the system support 
coherency between the instruction cache and the data cache, this pin can be set to 0. The Cortex-A73 
processor supports this coherency. 
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7 Level 2 Memory System 
7.4 ACE master interface 


This section describes the properties of the ACE master interface. The ACE interface to the system can 
be clocked at integer ratios of the CLK frequency. 


This section contains the following subsections: 


¢ 7.4.1 Memory interface attributes on page 7-353. 
e 7.4.2 ACE transfers on page 7-354. 

¢ 7.4.3 Read response on page 7-354. 
e 7.4.4 Write response on page 7-355. 
e 7.4.5 Barriers on page 7-355. 

¢ 7.4.6 AXI3 compatibility mode on page 7-355. 

e 7.4.7 AXI privilege information on page 7-355. 


7.4.1 Memory interface attributes 


The following table shows the ACE master interface attributes for the Cortex-A73 processor. The table 
lists the maximum possible values for the read and write issuing capabilities if the Cortex-A73 processor 
includes four cores, where n is the number of cores implemented, in the range | to 4. 


Table 7-1 ACE master interface attributes 








Attribute Value |Comments 
Write issuing capability 7n+24 | Each core can perform: 
e 7 Device write accesses. 
e 8 Non-cacheable write accesses. 
The whole cluster capability is: 
e 7n Device write accesses. 
e 8 Non-cacheable write accesses. 
* 16 cacheable write accesses. 
Read issuing capability 14n + 48 | Each core can perform: 


¢ 12 Strongly-ordered / Device data reads 
¢« 1 TLB Non-cacheable read 
¢ 1 Instruction Non-cacheable read 


The whole cluster capability is: 
e 48 cacheable reads. 





Exclusive thread capability 


n 


Each core can have one exclusive access sequence in progress. 


























Write ID capability lln + 16 | The Write ID capability is made up of: 
e 1 for Device nGnRnE for each core 
¢ 1 for Device nGnRE write for each core. 
¢ 1 for exclusive Device or Non-cacheable for each core 
¢ 8 for Non-cacheable writes for each core. 
¢ 16 for cacheable L2 evictions. 

Write ID width 8 The ID encodes the source of the memory transaction. 
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7.4 ACE master interface 


Table 7-1 ACE master interface attributes (continued) 





Attribute Value Comments 





Read ID capability 13n + 65 | The Read ID capability is made up of: 

e 1 for Device or Non-cacheable data reads for each core. 

e 1 for Non-cacheable instruction reads for each core. 

¢ 1 for TLB Non-cacheable reads for each core. 

e 1 for DVM operation. 

¢ 10 for CleanUnique operation for each core. 

e 16 for MakeUnique operation that is used for the streaming store. 
e 48 for cacheable reads. 





Read ID width 8 The ID encodes the source of the memory transaction. 

















7.4.2 ACE transfers 


The Cortex-A73 processor does not generate any FIXED bursts and all WRAP bursts fetch a complete 
cache line starting with the critical word first. A burst does not cross a cache line boundary. 


The cache linefill fetch length is always 64 bytes. 


The Cortex-A73 processor generates only a subset of all possible AXI transactions on the master 
interface. 


For Write-back (inner cacheable) transfers the supported transfers are: 


e WRAP 4 128-bit for read transfers. 
e INCR 4 128-bit for write transfers. 


For Non-cacheable transactions: 


NCR N (N:1-4) 128-bit for write transfers. 

NCR 1 64-bit for read transfers. 

NCR 1 8-bit, 16-bit, 32-bit, 64-bit, 128-bit for exclusive write transfers. 
NCR 1 8-bit, 16-bit, 32-bit, 64-bit, 128-bit for exclusive read transfers. 
WRAP 4 128-bit for read transfers. 








I 
I 
I 
I 


For Device transactions: 


INCR 1 8-bit, 16-bit, 32-bit, and 64-bit read transfers. 
INCR 1 8-bit, 16-bit, 32-bit, and 64-bit write transfers. 
INCR 1 8-bit, 16-bit, 32-bit, 64-bit, 128-bit exclusive read transfers. 
INCR 1 8-bit, 16-bit, 32-bit, 64-bit, 128-bit exclusive write transfers. 


For translation table walk transactions: 


e INCR 1 64-bit read transfers. 








The following points apply to AXI transactions: 

e WRAP bursts are only 128-bit. 

e INCR 1 can be any size up to 128-bits for read or write. 

e INCR burst, more than one transfer, are only 128-bit. 

e No transaction is marked as FIXED. 

e Write transfers with none or some byte strobes LOW can occur. 


7.4.3 Read response 


The ACE master can delay accepting a read data channel transfer by holding RREADY LOW for an 
indeterminate number of cycles. RREADY can be deasserted LOW between read data channel transfers 
that form part of the same transaction. 
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7.4 ACE master interface 
7.4.4 Write response 
The ACE master requires that the slave does not return a write response until it has received the write 
address. 
7.4.5 Barriers 


The Cortex-A73 processor never broadcasts barrier transactions to the interconnect. 
They are always terminated within the cluster and therefore, SYSBARDISABLE must be set to HIGH. 


When you terminate barriers within the cluster, ensure that your interconnect and any peripherals 
connected to it do not return a write response for a transaction until that transaction is considered 
complete by a later barrier. This means that the write must be observable to all other masters in the 
system. ARM expects the majority of peripherals to meet this requirement. 


7.4.6 AXI3 compatibility mode 


The Cortex-A73 processor implements an AXI3 compatibility mode that enables you to use the 
processor in a standalone environment where the AMBA 4 ACE interface is not required and the core 
does not propagate barriers outside of the cluster. 


To enable this mode you must set the SYSBARDISABLE input pin to HIGH on the boundary of the 
core. You must also ensure that the BROADCASTINNER, BROADCASTOUTER, and 
BROADCASTCACHEMAINT input pins are set to LOW. 


7.4.7 AXI privilege information 


AXI provides information about the privilege level of an access on the ARPROTM[2:0] and 
AWPROTM|2:0] signals. 


However, when accesses might be cached or merged together, the resulting transaction can have both 
privileged and unprivileged data combined. If this happens, the Cortex-A73 processor marks the 
transaction as privileged, even if it was initiated by an unprivileged process. 
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7.5 Additional memory attributes 
The Cortex-A73 processor simplifies the coherency logic by downgrading some memory types: 


e Memory that is marked as both Inner Write-Back Cacheable and Outer Write-Back Cacheable is 
cached in the L1 Data cache and the L2 cache. 

e Memory that is marked Inner Write-Through is downgraded to Non-cacheable. 

e Memory that is marked Outer Write-Through or Outer Non-cacheable is downgraded to Non- 
cacheable, even if the inner attributes are Write-Back cacheable. 


Note 


When MMU stage 1 translation is disabled and the instruction cache is enabled, memory marked as 
Outer Write-Through/Inner Write-Through is cached in the L1 instruction cache but not in the L2 cache. 








The attributes provided on ARCACHE or AWCACHE in ACE configurations are these downgraded 
attributes and indicate how the interconnect must treat the transaction. 


Some interconnects or bus protocols might require more information about the memory type and, for 
these cases, the cluster exports the unaltered memory attribute information from the translation tables 
stored in the TLB. These signals are for information only, and do not form part of the ACE protocol. 


There isa RDMEMATTR bus for the read channel and a WRMEMATTR bus for the write channel. 


The following table describes the encodings on the memory attribute bus. 


Table 7-2 Memory attribute bus encodings 





Bits | Encoding 





[7] | Outer shareable. 


Always set for device memory or memory that is both inner and outer non-cacheable. 





[6:3] | Outer memory type, or device type. 
If bits[1:0] indicate Device, then: 

¢  Bit[3] is ignored. 

e Bits[6:4] are: 

@beee nGnRnE. 

0be10 nGnRE. 

0b100 nGRE. 

@b110 GRE. 


If bits[1:0] indicate Normal, then: 


@be10@ NC. 
@b10RW WT. 
@b11RW WB. 


Where R is read allocate hint, W is write allocate hint. 
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7.5 Additional memory attributes 


Table 7-2 Memory attribute bus encodings (continued) 





Bits 


Encoding 





[2] 


Inner shareable. 


Anything with bit[7] set must also have bit[2] set. 





[1:0] 








Inner memory type: 


e@bee 
@be1 
0b10 
0b11 


Device. 
NC. 
WT. 
WB. 
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7.6 ACP 


7.6 ACP 


The Accelerator Coherency Port (ACP) is implemented as an AXI4 slave interface with 128-bit read and 
write buses. 


This section contains the following subsections: 
¢ 7.6.1 ACP interface restrictions on page 7-358. 
e 7.6.2 ACP requests on page 7-358. 


7.6.1 ACP interface restrictions 
The requirements of the ACP interface are: 


e All transactions have burst size equal to the data bus width, AxSIZE = b189. 
e All transaction burst addresses must be aligned to the burst length. 
e All transactions have burst type INCR, AxBURST = @be1. 
e Exclusive transactions are not supported, AxLOCK = @be. 
e All transactions are permitted to be Secure or Non-secure, AxPROT can take any value. 
e Quality of Service (QoS) is not supported, AxQOS is not present and is effectively @beeee. 
e Barrier transactions are not supported, AxBAR is not present and is effectively @bee. 
e Multiple address region signaling is not supported, AxREGION is not present and is effectively 
Qbeee0. 
e Cache maintenance transactions are not supported, AxSNOOP is not present and is effectively @bee. 
e A transaction ID width of up to 5 bits is supported. 
e Write interleaving is not supported. 
e All bursts must be aligned and two burst lengths are supported: 
— 16 byte burst, AxLEN = @b0e00000 and AXxADDRJ3:0] = ebeee0. 
— 64 byte burst, AxLEN = @b0@00011 and AxADDRJ5:0] = ebeeeee0e. 
e For write bursts: 
— 16-byte write bursts are permitted to have any combination of valid bytes. However, write bursts 
with no valid bytes are not supported. 
— 64-byte write bursts must have all bytes valid. 


Note 


e The ACP does not support non-cacheable transactions. 








7.6.2 ACP requests 


ARCACHE and AWCACHE are restricted to Normal, Write-Back, Read-Write-Allocate, Read-Allocate, 
Write-Allocate memory. 


ARCACHE and AWCACHE are limited to the values @b0111, @b1011, and @b1111. Other values cause 
an SLVERR response on RRESP or BRESP. 


Requests are treated as coherent requests. 


ACP coherent read requests 
In this case, the SCU enforces coherency. 


When the data is present in one of the cores within the multiprocessor, the data is read directly from the 
relevant core and returned to the ACP. 


When the data is not present in any of the cores, the read request is issued to the L2 cache. If data is 
present in the L2 cache, it is returned to the ACP. If the data is not present, the L2 cache performs a 
linefill before returning the data. 
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7.6 ACP 


ACP coherent write requests 
In this case, the SCU enforces coherency. 


When the data is present in one of the cores within the multiprocessor the data is first cleaned and 
invalidated from the relevant core. 


When the data is not present in any of the cores, or when it has been cleaned and invalidated, the write 
request is issued to the L2 cache. In the case of an L2 cache hit, the line is updated. On a miss, a line is 
allocated in the L2 cache. 
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7.7 External aborts and asynchronous errors 
This section describes external aborts and asynchronous errors. 


This section contains the following subsections: 
¢ 7.7.1 External aborts on page 7-360. 
e 7.7.2 Asynchronous errors on page 7-360. 


7.7.1 External aborts 


The L2 memory system handles external aborts depending on the instruction executed and attributes of 
the memory region of the access: 


e External aborts on writes to Non-cacheable Normal memory or Device memory are indicated by 
asserting the nAXIERRIRQ signal. 

e External aborts on evictions from the caches are indicated by asserting the nAXIERRIRQ signal. 

e All other external aborts are reported to the core as asynchronous imprecise aborts. 


7.7.2 Asynchronous errors 


The L2 memory system has two outputs that indicate asynchronous error conditions. An asynchronous 
external error condition exists when either: 


¢« The nAXIERRIRQ output is asserted LOW. 
* The n9ECCERRIRQ output is asserted LOW. 


If an asynchronous error condition is detected, the corresponding bit in the L2 Extended Control Register 
is asserted. The asynchronous error condition can be cleared by writing @ to the corresponding bit of the 
L2ECTLR. Software can only clear the LZECTLR. Any attempt to assert the error by writing the 
L2ECTLR is ignored. See 4.3.72 L2 Extended Control Register on page 4-171 for more information. 


External errors on the ACE write response channel or on the ACE read data channel, associated with a 
write-allocate memory transaction, cause the nAXIERRIRQ signal to be asserted LOW. 


Double-bit ECC errors cause the nRECCERRIRQ signal to be asserted LOW. 


Any external error associated with a load instruction is reported back to the requester along with an error 
response and this might trigger an abort. 
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Chapter 8 
Generic Interrupt Controller CPU Interface 


This chapter describes the Cortex-A73 processor implementation of the ARM Generic Interrupt 
Controller (GIC) CPU interface. 


It contains the following sections: 


¢ 8.1 About the Generic Interrupt Controller CPU Interface on page 8-362. 
e 8.2 GIC CPU interface programmers model on page 8-363. 
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8.1 About the Generic Interrupt Controller CPU Interface 


The GIC CPU Interface, when integrated with an external distributor component, is a resource for 
supporting and managing interrupts in a cluster system. 


It provides: 


e Registers for managing: 
— Interrupt sources. 
— Interrupt behavior. 
— Interrupt routing to one or more cores. 


The Cortex-A73 processor implements the GIC CPU interface as described in the Generic Interrupt 
Controller (GICv4) architecture. This interfaces with an external GICv3 or GICv4 interrupt distributor 
component within the system. 


The GICv4 architecture supports: 


e Two security states. 

¢ Interrupt virtualization. 

¢ Software-generated Interrupts (SGIs). 

e Message Based Interrupts. 

e System register access for the CPU interface. 

e Memory mapped register access for distributor registers, as well as CPU registers when using the 
GIC configured in legacy mode. 

e Interrupt masking and prioritization. 

e Cluster environments, including systems that contain more than eight cores. 

e Wake-up events in power management environments. 


The GIC includes interrupt grouping functionality that supports: 

e Configuring each interrupt to belong to an interrupt group. 

e Signaling Group | interrupts to the target processor using either the IRQ or the FIQ exception 
request. 

¢ Signaling Group 0 interrupts to the target processor using the FIQ exception request only. 

¢ A unified scheme for handling the priority of Group 0 and Group 1 interrupts. 


This chapter describes only features that are specific to the Cortex-A73 processor implementation. 


This section contains the following subsections: 
¢ 8.1.1 Bypassing the CPU Interface on page 8-362. 


8.1.1 Bypassing the CPU Interface 
The GIC CPU Interface is always implemented within the Cortex-A73 processor. 


However, you can disable it if you assert the GICCDISABLE signal HIGH at reset. If the GIC is 
enabled, the input pins nVIRQ and nVFIQ must be tied off to HIGH. This is because the internal GIC 
CPU interface generates the virtual interrupt signals to the cores. The nIRQ and nFIQ signals are 
controlled by software, therefore there is no requirement to tie them HIGH. If you disable the GIC CPU 
interface, the input pins nVIRQ and nVFIQ can be driven by an external GIC in the SoC. 


You can disable the CPU Interface, when the Cortex-A73 processor is not being integrated with an 
external GICv3 or GICv4 distributor component in the system, by asserting the GICCDISABLE signal 
HIGH at reset. 


Asserting the GICCDISABLE signal HIGH at reset removes access to the memory-mapped and system 
GIC CPU Interface registers. 
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8.2 GIC CPU interface programmers model 
This section describes the GIC CPU interface programmers model for the Cortex-A73 processor. 


This section contains the following subsections: 

* 8.2.1 Memory map on page 8-363. 

e 8.2.2 CPU interface register summary on page 8-363. 

e 8.2.3 CPU interface register descriptions on page 8-366. 

¢ 8.2.4 Virtual interface control register summary on page 8-367. 

e 8.2.5 Virtual interface control register descriptions on page 8-369. 
e 8.2.6 Virtual CPU interface register summary on page 8-370. 

e 8.2.7 Virtual CPU interface register descriptions on page 8-370. 


8.2.1 Memory map 


The Cortex-A73 processor GIC CPU Interface implements a memory-mapped interface. The memory- 
mapped interface is offset from PERIPHBASE. The following table lists the address ranges. 


Table 8-1 Memory Map 


Address range Functional block 





0x00000-Ox@1FFF | CPU Interface 





Qx02000-Ox@FFFF | Reserved 





Q@x10000-0x10FFF | Virtual Interface Control 





@x11000-Ox1FFFF | Reserved 





Q@x20000-0x21FFF | Virtual CPU Interface 





0x22000-0x2EFFF | Reserved 





0x2F000-0x30FFF | Alias of Virtual CPU Interface 














0x31000-@x3FFFF | Reserved 





Note 
These registers are not available if GICCDISABLE is asserted. 





8.2.2 CPU interface register summary 


Each CPU interface block provides the interface for a Cortex-A73 processor that interfaces with a GIC 
distributor within the system. Each CPU interface provides a programming interface for: 


¢ Enabling the signaling of interrupt requests by the CPU interface. 
e Acknowledging an interrupt. 

e Indicating completion of the processing of an interrupt. 

¢ Setting an interrupt priority mask for the core. 

¢ Defining the preemption policy for the core. 

¢ Determining the highest priority pending interrupt for the core. 

e Generating SGIs. 


For more information on the CPU interface, see the ARM® Generic Interrupt Controller Architecture 
Specification. 


The following table lists the registers for the CPU interface, all of which are word-accessible. Registers 
not described in this table are Reso. See the ARM” Generic Interrupt Controller Architecture Specification 
for more information. 
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Table 8-2 CPU interface register summary 




































































Offset | Name Type | Reset Description 
@x8000 | GICC_CTLR RW |@0x00000000 CPU Interface Control Register 
0x0004 | GICC_PMR RW |@0x00000000 Interrupt Priority Mask Register 
Qx0008 | GICC_BPR RW | @x@ee00002 (S)°Y | Binary Point Register 
0x00000003 (NS)? 
Q@x@@@C | GICC_IAR RO | - Interrupt Acknowledge Register 
0x0010 | GICC_EOIR WO |- End Of Interrupt Register 
090x0014 | GICC_RPR RO |@0x000000FF Running Priority Register 
0x0018 | GICC_HPPIR |RO |@0x000003FF Highest Priority Pending Interrupt Register 
@x@@1C | GICC_ABPR RW |@0x00000003 Aliased Binary Point Register 
0x0020 | GICC_AIAR RO |l- Aliased Interrupt Acknowledge Register 
090x0024 | GICC_AEOIR |WO |- Aliased End of Interrupt Register 
0x0028 | GICC_AHPPIR | RO |@0x000003FF Aliased Highest Priority Pending Interrupt Register 
@x@@DO | GICC_APRO RW |@0x00000000 Active Priority Register on page 8-366 
Ox00EO | GICC_NSAPRO | RW | 0x00000000 Non-secure Active Priority Register 
@x@@FC | GICC_IIDR RO | 0x94043B CPU Interface Identification Register on page 8-366 
@x1000 | GICC_DIR WO |- Deactivate Interrupt Register 





The following table shows the System register map for the CPU interface in AArch32. See the ARM® 
Generic Interrupt Controller Architecture Specification, GICv3 for more information about the registers. 


Table 8-3 AArch32 GIC CPU interface System register summary 






























































Name CRn | op1 | CRm | op2 | Type | Description 
ICC_ PMR c4 0 c6 0 RW Priority Mask Register 
ICC_IARO cl2 |0 c8 0 RO Group0 Interrupt Acknowledge Register 
ICC_EOIRO 1 WO Group0 End of Interrupt Register 
ICC_HPPIRO 2 RO Group0 Highest Priority Pending Interrupt Register 
ICC_BPRO 3 RW Group0 Binary Pointer Register 
ICC_APORO 4 RW Active Priorities 0 Register 0 
ICC_AP1RO c9 0 RW Active Priorities 1 Register 0 
ICC_DIR cll 1 WO Deactivate Register 
ICC_RPR 3 RO Running Priority Register 

by S= Secure. 

bz NS =Non-secure. 
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Table 8-3 AArch32 GIC CPU interface System register summary (continued) 































































































Name CRn | op1 | CRm | op2 | Type | Description 

ICC_IAR1 c12 JO RO Group! Interrupt Acknowledge Register 
ICC_EOIR1 1 WO Group! End of Interrupt Register 

ICC_HPPIR1 2 RO Group! Highest Priority Pending Interrupt Register 
ICC_BPR1 3 RW B®? | Group! Binary Pointer Register 

ICC_CTLR 4 RWB | Control Register 

ICC_SRE 5 RWB |System Register Enable 

ICC_IGRPENO 6 RW Group0 Interrupt Group Enable 

ICC_IGRPEN1 7 RWB | Group! Interrupt Group Enable 

ICC_SGHR° - WO Group! Software Generated Interrupt Register 
ICC_ASGI1R 0 c12 |- WO Aliased Group! Software Generated Interrupt Register 
ICC_SGIOR 2 c12 |- WO Group0 Software Generated Interrupt Register 
ICC_MCTLR 6 cl2 |4 RW Monitor Control Register 

ICC_MSRE > RW Monitor System Register Enable 

ICC_MGRPEN1 7 RW Monitor Group! Interrupt Group Enable 





The following table shows the System register map for the GIC CPU interface in AArch64. See the 
ARM® Generic Interrupt Controller Architecture Specification, GICv3 for more information about the 
registers. 


Table 8-4 AArch64 GIC CPU interface System register summary 











Name Type |Description 
ICC_PMR ELI RW Priority Mask Register 
ICC_IARO EL1 RO Group0 Interrupt Acknowledge Register 





ICC_EOIRO_EL1 WO Group0 End of Interrupt Register 





ICC_HPPIRO ELI |RO Group0 Highest Priority Pending Interrupt Register 





ICC_BPRO EL1 RW Group0 Binary Pointer Register 





ICC_APORO_ EL1 RW Active Priorities 0 Register 0 





ICC_AP1RO_EL1 RW Active Priorities 1 Register 0 





ICC_DIR_ELI1 WO Deactivate Register 





ICC_RPR_EL1 RO Running Priority Register 





ICC_SGI1R_EL1 WO Group! Software Generated Interrupt Register 





ICC_ASGI1R_EL1 |WO Aliased Group! Software Generated Interrupt Register 





ICC_SGIOR_EL1 WO Group0 Software Generated Interrupt Register 





ICC_IARI_EL1 RO Group! Interrupt Acknowledge Register 

















ca When operating in EL3, accesses to Banked ELI registers access the copy designated by the current value of the SCR_EL3.NS. When EL3 is using AArch32, there 
is no Secure EL1 interrupt regime and accesses in any Secure EL3 mode, except Monitor mode, access the Secure copy. 
cb Use MCRR instructions to access this register in AArch32 state. 
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Table 8-4 AArch64 GIC CPU interface System register summary (continued) 





Name Type |Description 





ICC_EOIR1_EL1 WO Group! End of Interrupt Register 





ICC_HPPIR1 EL1 |RO Group! Highest Priority Pending Interrupt Register 





ICC _BPR1_EL1 RW B® | Group! Binary Pointer Register 





ICC_CTLR_EL1 RW B_| Control Register 





ICC_SRE EL1 RW B_| System Register Enable 





ICC_IGRPENO_EL1 | RW Group0 Interrupt Group Enable Register 





ICC_IGRPEN1_EL1|RWB_ | Group! Interrupt Group Enable 





ICC_CTLR_EL3 RW EL3 Control Register 





ICC_SRE EL3 RW EL3 System Register Enable 





ICC_GRPEN1 _EL3 | RW EL3 Group! Interrupt Group Enable 














8.2.3 CPU interface register descriptions 


This section describes only registers whose implementation is specific to the Cortex-A73 processor. 


All other registers are described in the ARM® Generic Interrupt Controller Architecture Specification. 


Active Priority Register 

The GICC_APRO characteristics are: 

Purpose Provides support for preserving and restoring state in power management 
applications. 


Usage constraints This register is banked to provide Secure and Non-secure copies. This ensures that 
Non-secure accesses do not interfere with Secure operation. 


Configurations Available in all configurations. 


Attributes See the register summary in the following table. 


The Cortex-A73 processor implements the GICC_APRO according to the recommendations described in 
the ARM® Generic Interrupt Controller Architecture Specification. 


The following table shows the Cortex-A73 MPCore GICC_APRO implementation. 


Table 8-5 Active Priority Register implementation 











Number of /| Preemption Minimum legal | Minimum legal | Active Priority View of Active Priority 
group levels value of Secure | value of Non- Registers Registers for Non-secure 
priority bits GICC_BPR secure implemented accesses 

GICC_BPR 
5 2 3 GICC_APRO[31:0] GICC_NSAPROJ[31:16] appears 





as GICC_APRO[15:0] 




















CPU Interface Identification Register 
The GICC_IIDR characteristics are: 


Purpose Provides information about the implementer and revision of the CPU interface. 





cc When operating in EL3, accesses to Banked ELI registers access the copy designated by the current value of the SCR_EL3.NS. When EL3 is using AArch32, there 
is no Secure EL] interrupt regime and accesses in any Secure EL3 mode, except Monitor mode, access the Secure copy. 
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Usage constraints There are no usage constraints. 


Configurations 
Attributes 


Available in all configurations. 
GICC_UDR is a 32-bit register. 


The following figure shows the GICC_IIDR bit assignments. 


31 20 19 16 15 12 11 0 


ProductID Architecture Implementer 
version 


Figure 8-1 GICC_IIDR bit assignments 


The following table shows the GICC_IIDR bit assignments. 


Table 8-6 GICC_IIDR bit assignments 



































Bit Name Function 
[31:20] | ProductID Identifies the product: 
0x9 Cortex-A73 processor. 
[19:16] | Architecture version | Identifies the architecture version of the GICCPU Interface: 
0x4 GICv4. 
[15:12] | Revision Identifies the revision number for the CPU interface: 
0x0 r0p0. 
[11:0] | Implementer Contains the JEP106 code of the company that implements the CPU interface. For an ARM 
implementation, these values are: 
Bits[11:8]=@x4 The JEP106 continuation code of the implementer. 
Bit[7] Always 0. 
Bits[6:0] =@x3B The JEP106 identity code of the implementer. 
8.2.4 Virtual interface control register summary 


The virtual interface control registers are management registers. Configuration software on the Cortex- 
A73 processor must ensure they are accessible only by a hypervisor, or similar software. 


The following table describes the registers for the virtual interface control registers. 


All the registers in the following table are word-accessible. Registers not described in this table are REso. 
See the ARM” Generic Interrupt Controller Architecture Specification for more information. 


Table 8-7 Virtual interface control register summary 





Offset | Name Type | Reset Description 





0x000 | GICH HCR RW |@0x00000000 | Hypervisor Control Register 





0x004 | GICH_VTR RO | 0x900000@3 | VGIC Type Register on page 8-369 





0x008 | GICH_VMCR |RW_ |@0x004C0000 | Virtual Machine Control Register 





0x010 | GICH_MISR |RO |@0x00000000 | Maintenance Interrupt Status Register 





0x020 | GICH_EISRO |RO_ |@0x00000000 | End of Interrupt Status Registers 








0x030 | GICH_ELRSRO|RO _ |0x0000000F | Empty List Register Status Registers 
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Table 8-7 Virtual interface control register summary (continued) 
































Offset | Name Type | Reset Description 

@xO@F®@ | GICH_APRO RW |@0x00000000 | Active Priorities Register 
0x100 | GICH_LRO RW | 0x00000088 | List Register 0 

0x104 | GICH_LR1 RW | 0x00000080 | List Register 1 

0x108 | GICH_LR2 RW | 0x00000080 | List Register 2 

@x1@C | GICH_LR3 RW | 0x000008@0 | List Register 3 











The following table shows the register map for the AArch32 virtual interface System registers. The 
offsets in this table are relative to the virtual interface control registers block base address as shown in 
Table 8-1 Memory Map on page 8-363. 


All the registers in the following table are word-accessible. Registers not described in this table are 


Reserved. 


Table 8-8 AArch32 virtual interface System register summary 




























































































Name CRn | op1 | CRm | op2 | Type | Description 

ICH_APRO |cl2 |4 c 0 RW | Hypervisor Active Priority Register 0 
ICH_APRI1 c9 0 RW | Hypervisor Active Priority Register 1 
ICH_VSEIR 4 RW | Virtual System Error Interrupt Register 
ICH_SRE 5 RW _| Hypervisor System Register 
ICH_HCR 4 cll JO RW | Hypervisor Control Register 
ICH_VTR 1 RO | VGIC Type Register 

ICH_MISR 2 RO | Maintenance Interrupt Status Register 
ICH_EISR 3 RO | End of Interrupt Status Register 
ICH_ELRSR 5 RO | Empty List Register Status Register 
ICH_VMCR n RW _| Virtual Machine Control Register 
ICH_LRO c12 JO RW |List Register 0 to 3 

ICH_LR1 1 RW 

ICH_LR2 2 RW 

ICH_LR3 3 RW 

ICH_LRCO cl4 JO RW _ | List Register Extension 0 to 3 
ICH_LRC1 1 RW 

ICH_LRC2 2 RW 

ICH_LRC3 3 RW 














The following table shows the register map for the AArch64 virtual interface System registers. The 
offsets in this table are relative to the virtual interface control registers block base address as shown in 
Table 8-1 Memory Map on page 8-363. 


All the registers in the following table are word-accessible. Registers not described in this table are 


Reserved. 
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Table 8-9 AArché64 virtual interface System register summary 





Name Type | Description 





ICH_APRO EL2 |RW_ | Hypervisor Active Priority Register 





ICH_VSEIR_EL2 | RW_ | Virtual System Error Interrupt Register 





ICH_HCR_EL2 RW | Hypervisor Control Register 





ICH_VTR_EL2 |RO_ | VGIC Type Register 





ICC_SRE EL2 RW | Hypervisor System Register Enable 





ICH_MISR_EL2 |RO_ | Maintenance Interrupt Status Register 





ICH_EISR_EL2 |RO_ | End of Interrupt Status Register 





ICH_ELRSR_EL2|]RO_ | Empty List Register Status Register 





ICH_VMCR_EL2 | RW _| Virtual Machine Control Register 





ICH_LRO EL2 RW | List Register 0 





ICH_LR1_EL2 RW | List Register 1 





ICH_LR2_ EL2 RW _ | List Register 2 





ICH_LR3_EL2 RW | List Register 3 

















Virtual interface control register descriptions 


This section describes only registers whose implementation is specific to the Cortex-A73 processor. 


All other registers are described in the ARM® Generic Interrupt Controller Architecture Specification. 


VGIC Type Register 
The GICH_VTR characteristics are: 


Purpose Holds information on number of priority levels, number of preemption bits, and 
number of List registers implemented. 


Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 
Attributes GICH_VTR is a 32-bit register. 
The following figure shows the GICH_VTR bit assignments. 


31 2928 2625 6 5 0 


Figure 8-2 GICH_VTR bit assignments 
The following table shows the GICH_VTR bit assignments. 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 8-369 


reserved. 
Non-Confidential 


8 Generic Interrupt Controller CPU Interface 
8.2 GIC CPU interface programmers model 


Table 8-10 GICH_VTR bit assignments 


































































































Bit Name |Description 
[31:29] | PRIbits | Indicates the number of priority bits implemented, minus one: 
0x4 Five bits of priority and 32 priority levels. 
[28:26] | PREbits | Indicates the number of preemption bits implemented, minus one: 
0x4 Five bits of preemption and 32 preemption levels. 
[25:6] |- Reserved, RESO. 
[5:0] | ListRegs | Indicates the number of implemented List registers, minus one: 
0x3 Four List registers. 
8.2.6 Virtual CPU interface register summary 
The virtual CPU interface forwards virtual interrupts to a connected Cortex-A73 processor, subject to the 
normal GIC handling and prioritization rules. The virtual interface control registers control virtual CPU 
interface operation, and in particular, the virtual CPU interface uses the contents of the List registers to 
determine when to signal virtual interrupts. When a core accesses the virtual CPU interface, the List 
registers are updated. 
For more information on the virtual CPU interface, see the ARM® Generic Interrupt Controller 
Architecture Specification. The following table describes the registers for the virtual CPU interface. 
All the registers in the following table are word-accessible. Registers not described in this table are REso. 
See the ARM” Generic Interrupt Controller Architecture Specification for more information. 
Table 8-11 Virtual CPU interface register summary 
Name Type | Reset Description 
GICV_CTLR |RW_ | 0x@0000000 | VM Control Register 
GICV_PMR RW |@0x00000000 | VM Priority Mask Register 
GICV_BPR RW |@0x00000002 | VM Binary Point Register 
GICV_IAR RO |- VM Interrupt Acknowledge Register 
GICV_EOIR WO |- VM End Of Interrupt Register 
GICV_RPR RO |@0x000000FF | VM Running Priority Register 
GICV_HPPIR |RO_ |@0x000003FF | VM Highest Priority Pending Interrupt Register 
GICV_ABPR  |RW_ | 0x@0@000003 | VM Aliased Binary Point Register 
GICV_AIAR RO |- VM Aliased Interrupt Acknowledge Register 
GICV_AEOIR | WO |- VM Aliased End of Interrupt Register 
GICV_AHPPIR|RO_ | @x@00003FF | VM Aliased Highest Priority Pending Interrupt Register 
GICV_APRO RW | 0x00000080 | VM Active Priority Register on page 8-371 
GICV_IIDR RO | 0x@094443B | VM CPU Interface Identification Register on page 8-371 
GICV_DIR WO |- VM Deactivate Interrupt Register 
8.2.7 Virtual CPU interface register descriptions 
This section describes only registers whose implementation is specific to the Cortex-A73 processor. 
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All other registers are described in the ARM® Generic Interrupt Controller Architecture Specification. 


VM Active Priority Register 

The GICV_APRO characteristics are: 

Purpose For software compatibility, this register is present in the virtual CPU interface. 
However, in a virtualized system, it is not used when preserving and restoring state. 


Usage constraints Reading the content of this register and then writing the same values must not 
change any state because there is no requirement to preserve and restore state during 
a powerdown. 


Configurations Available in all configurations. 
Attributes GICV_APRO is a 32-bit register. 


The Cortex-A73 processor implements the GICV_APRO as an alias of GICH_APRO. 


VM CPU Interface Identification Register 

The GICV_IIDR characteristics are: 

Purpose Provides information about the implementer and revision of the virtual CPU 
interface. 

Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 
Attributes GICV_IIDR is a 32-bit register. 


The bit assignments for the VM CPU Interface Identification Register are identical to the corresponding 
register in the CPU interface, see CPU Interface Identification Register on page 8-366. 
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Chapter 9 
Generic Timer 


This chapter describes the Generic Timer for the Cortex-A73 processor. 


It contains the following sections: 

¢ 9.1 About the Generic Timer on page 9-373. 

e 9.2 Generic Timer functional description on page 9-374. 
e 9.3 Generic Timer register summary on page 9-375. 
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9.1 About the Generic Timer 


The Generic Timer can schedule events and trigger interrupts based on an incrementing counter value. It 
provides: 


e Generation of timer events as interrupt outputs. 
e Generation of event streams. 


The Cortex-A73 Generic Timer is compliant with the ARM® Architecture Reference Manual ARMV6, for 
ARMVv8-A architecture profile. 


This chapter describes only features that are specific to the Cortex-A73 processor implementation. 
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9.2 Generic Timer functional description 


The Cortex-A73 processor provides a set of timer registers within each core of the cluster. The timers 
are: 


e An ELI Non-secure physical timer. 
e An ELI Secure physical timer. 

e An EL2 physical timer. 

e A virtual timer. 


The Cortex-A73 processor does not include the system counter. This resides in the SoC. The system 
counter value is distributed to the Cortex-A73 processor with a synchronous binary encoded 64-bit bus, 
CNTVALUEB[63:0]. 


Because CNT VALUEB[63:0] is generated from a system counter that typically operates at a slower 
frequency than CLK, the CNTCLKEN input is provided as a clock enable for the CNTVALUEB[63:0] 
bus. CNTCLKEN is registered inside the Cortex-A73 processor before being used as a clock enable for 
the CNTVALUEB[63:0] registers. This allows a multicycle path to be applied to the 
CNTVALUEB[63:0] bus. The following figure shows the interface. 














Processor 
CNTCLKEN CNTCLKEN 
register 
Architectural 
counter 
Glock gate registers 











CNTVALUEBJ63:0] 

















Figure 9-1 Architectural counter interface 


The value on the CNTVALUEB[63:0] bus is required to be stable whenever the internally registered 
version of the CNTCLKEN clock enable is asserted. CNTCLKEN must be synchronous and balanced 
with CLK and must toggle at integer ratios of CLK. 


See 2.3.7 Clocks on page 2-33 for more information about CNTCLKEN. 
Each timer provides an active-LOW interrupt output to the SoC. 


The following table shows the signals that are the external interrupt output pins. 


Table 9-1 Generic Timer signals 





Signal“¢ Description 





nCNTPNSIRQJ[n:0] | EL1 Non-secure physical timer event 





nCNTPSIRQ[n:0] |EL1 Secure physical timer event 





nCNTHPIRQ[n:0] | EL2 physical timer event 





nCNTVIRQJ[n:0] Virtual timer event 

















cd n is the number of cores present in the cluster, minus one. 
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9 Generic Timer 
9.3 Generic Timer register summary 


A set of Generic Timer registers are allocated within each core. The Generic Timer registers are either 32 
bits wide or 64 bits wide and are accessible in the AArch32 and AArch64 execution states. 


This section contains the following subsections: 
e 9.3.1 AArch64 Generic Timer register summary on page 9-375. 
e 9.3.2 AArch32 Generic Timer register summary on page 9-375. 


9.3.1 AArch64 Generic Timer register summary 


The following table shows the AArch64 Generic Timer registers. 


Table 9-2 AArch64 Generic Timer registers 
































Name Reset | Width | Description 
NTKCTL_EL1 =e 32-bit | Counter-timer Kernel Control register 
NTFRQ ELO UNK | 32-bit | Counter-timer Frequency register 
NTPCT_ELO UNK | 64-bit | Counter-timer Physical Count register 
NTVCT_ELO UNK | 64-bit | Counter-timer Virtual Count register 
NTP_TVAL ELO |UNK_ | 32-bit | Counter-timer Physical Timer TimerValue register 
NTP_CTL_ELO ei 32-bit | Counter-timer Physical Timer Control register 
NTP_CVAL_ELO |UNK_ | 64-bit | Counter-timer Physical Timer CompareValue register 
N 


TV_TVAL ELO |UNK | 32-bit | Counter-timer Virtual Timer TimerValue register 





NTV_CTL_ELO ut 32-bit | Counter-timer Virtual Timer Control register 





INK |64-bit | Counter-timer Virtual Timer CompareValue register 











NTVOFF_EL2 


INK |64-bit | Counter-timer Virtual Offset register 








NTHCTL_EL2 -8 32-bit | Counter-timer Hypervisor Control register 











NTHP_TVAL _EL2|}UNK_ | 32-bit | Counter-timer Hypervisor Physical Timer TimerValue register 





NTHP CTL EL2 |-% 32-bit | Counter-timer Hypervisor Physical Timer Control register 





NTHP_CVAL EL2}UNK_ | 64-bit | Counter-timer Hypervisor Physical Timer CompareValue register 





NTPS TVAL EL! |UNK | 32-bit | Counter-timer Physical Secure Timer TimerValue register 





NTPS_CTL_EL1 |-% 32-bit | Counter-timer Physical Secure Timer Control register 














c 
c 
c 
c 
c 
c 
c 
c 
C 
CNTV_CVAL_ELO 
c 
c 
C 
c 
c 
c 
c 
c 














NTPS_CVAL_EL1 | UNK |64-bit | Counter-timer Physical Secure Timer CompareValue register 








See the ARM® Architecture Reference Manual ARMV8, for ARMv8-A architecture profile for information 


about these registers. 


9.3.2 AArch32 Generic Timer register summary 


The following table shows the AArch32 Generic Timer registers. 





ce The reset value for bits[9:8, 2:0] is 2600000. 
cf The reset value for bit[0] and bit[1] is 2. 
c8 The reset value for bit[2] is ð and for bits[1:0] is @b11. 
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Table 9-3 AArch32 Generic Timer registers 
















































































Name Reset | Width | Description 

CNTFRQ UNK | 32-bit | Counter-timer Frequency register 

CNTPCT UNK | 64-bit | Counter-timer Physical Count register 

CNTKCTL aN 32-bit | Counter-timer Kernel Control register 

CNTP_TVAL |UNK |32-bit | Counter-timer Physical Timer TimerValue register 
CNTP_CTL aa 32-bit | Counter-timer Physical Timer Control register 
CNTV_TVAL |UNK_ | 32-bit | Counter-timer Virtual Timer TimerValue register 
CNTV_CTL fi 32-bit | Counter-timer Virtual Timer Control register 
CNTVCT UNK | 64-bit | Counter-timer Virtual Count register 

CNTP_CVAL | UNK_ | 64-bit | Counter-timer Physical Timer CompareValue register 
CNTV_CVAL |UNK | 64-bit | Counter-timer Virtual Timer CompareValue register 
CNTVOFF UNK | 64-bit | Counter-timer Virtual Offset register 

CNTHCTL 2q 32-bit | Counter-timer Hyp Control register 

CNTHP_TVAL | UNK |32-bit | Counter-timer Hyp Physical Timer TimerValue register 
CNTHP_CTL_ | -“% 32-bit | Counter-timer Hyp Physical Timer Control register 
CNTHP_CVAL | UNK | 64-bit | Counter-timer Hyp Physical CompareValue register 














See the ARM® Architecture Reference Manual ARMV8, for ARMvS8-A architecture profile for information 
about these registers. 





ch The reset value for bits[9:8, 2:0] is @b00000. 
Cl The reset value for bit[0] and bit[1] is ©. 
©) The reset value for bit[2] is @ and for bits[1:0] is @b11. 
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Chapter 10 
Debug 


This chapter describes the Cortex-A73 processor debug registers and shows examples of how to use 
them. 


It contains the following sections: 

e 10.1 About debug on page 10-378. 

¢ 10.2 Debug register interfaces on page 10-379. 

¢ 10.3 AArch64 debug register summary on page 10-381. 

e 10.4 AArch64 debug register descriptions on page 10-384. 

e 10.5 AArch32 debug register summary on page 10-389. 

e 10.6 AArch32 debug register descriptions on page 10-393. 

e 10.7 Memory-mapped debug register summary on page 10-397. 
¢ 10.8 Memory-mapped debug register descriptions on page 10-401. 
e 10.9 Debug events on page 10-411. 

¢ 10.10 External debug interface on page 10-412. 

e 10.11 ROM table on page 10-415. 
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10.1 About debug 


This section gives an overview of debug and describes the debug components. The Cortex-A73 
processor forms one component of a debug system. 


You can use the following debug methods: 


Conventional self-hosted debug (previously known as monitor debug) 
For self-hosted debug, the debug target runs additional debug monitor software that runs on the 
Cortex-A73 processor itself, rather than requiring expensive interface hardware to connect a 
second host computer. 
Conventional external debug (known as JTAG debug on SoC) 
This is invasive debug with the core halted using: 
e Breakpoints, watchpoints, exception catches, and various asynchronous debug events to halt 
the core on specific activities. 
e A debug connection through a specific channel to examine and modify registers and 
memory, and provide single-step execution. 


The following figure shows a typical external debug system. 





Debug 


host Debug host computer running suitable debugger tool 


O 














Protocol 


for example, DSTREAM or RealView ICE 
converter 


v 














Debug 


target Development system containing ARM processor 











Figure 10-1 Typical debug system 
This typical system has several parts: 


Debug host 
The debug host is a computer, for example a personal computer, running a software debugger 
such as the DS-5 Debugger. The debug host enables you to issue high-level commands such as 
setting breakpoint at a certain location, or examining the contents of a memory address. 
Protocol converter 
The debug host sends messages to the debug target using an interface such as Ethernet. 
However, the debug target typically implements a different interface protocol. A device such as 
DSTREAM is required to convert between the two protocols. 
Debug target 
The debug target is the lowest level of the system. An example of a debug target is a 
development system with a test chip or a silicon part with a processor. 


The debug target implements system support for the protocol converter to access the debug unit 
using the Advanced Peripheral Bus (APB) slave interface. 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 10-378 
reserved. 
Non-Confidential 


10 Debug 
10.2 Debug register interfaces 


10.2 Debug register interfaces 
The Debug architecture defines a set of debug registers. 
The debug register interfaces provide access to these registers from: 


¢ Software running on the processor. 
e An external debugger. 


The Cortex-A73 processor implements the ARMv8 Debug architecture and debug events as described in 
the ARM® Architecture Reference Manual ARMv6, for ARMv8-A architecture profile. 


This section contains the following subsections: 

e 10.2.1 Core interfaces on page 10-379. 

¢ 10.2.2 Breakpoints and watchpoints on page 10-379 

¢ 10.2.3 Effects of resets on debug registers on page 10-379. 
e 10.2.4 External access permissions on page 10-380. 


10.2.1 Core interfaces 


System register access allows the core to directly access certain debug registers. The external debug 
interface enables both external and self-hosted debug agents to access debug registers. 


See 70.10 External debug interface on page 10-412 for more information. 
Access to the debug registers is partitioned as follows: 


Debug registers 
This function is system register based and memory-mapped. You can access the debug register 
map using the APB slave port. See 70.10 External debug interface on page 10-412. 
Performance monitor 
This function is system register based and memory-mapped. You can access the performance 
monitor registers using the APB slave port. See 70.10 External debug interface on page 10-412. 
Trace registers 
This function is memory-mapped. See 70.10 External debug interface on page 10-412. 
Cross Trigger Interface registers 
This function is memory-mapped. You can access the performance monitor registers using the 
APB slave port. See Chapter 13 Cross Trigger on page 13-526. 


10.2.2 Breakpoints and watchpoints 


The processor supports six breakpoints, four watchpoints, and a standard Debug Communications 
Channel (DCC). 


A breakpoint consists of a breakpoint control register and a breakpoint value register. These two registers 
are referred to as a Breakpoint Register Pair (BRP). 


Four of the breakpoints (BRP 0 to 3) match only to virtual address and the other two (BRP 4 and 5) 
match against either virtual address or context ID, or Virtual Machine Identifier (VMID). All the 
watchpoints can be linked to two breakpoints (BRP 4 and 5) to enable a memory request to be trapped in 
a given process context. 


10.2.3 Effects of resets on debug registers 


The Cortex-A73 processor has the following reset signals that affect the debug registers: 


nCPUPORESET/[CN:0] 
This signal initializes the core logic, including the debug, Embedded Trace Macrocell (ETM) 
trace unit, breakpoint and watchpoint logic. This maps to a Cold reset that covers reset of the 
core logic and the integrated debug functionality. 
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This signal resets some of the debug logic (excluding breakpoints and watchpoints) and 
performance monitor logic. This maps to a Warm reset that covers reset of the core logic. 


nPRESETDBG 


This signal initializes the shared debug APB, top debug, top ETM, top performance monitor 
logic, Cross Trigger Interface (CTI), and Cross Trigger Matrix (CTM) logic. This maps to an 
external debug reset that covers the resetting of the external debug interface and has no impact 


on the core functionality. 


























10.2.4 External access permissions 
External access permission to the debug registers is subject to the conditions at the time of the access. 
The following table describes the core response to accesses through the external debug interface. 
Table 10-1 External register conditions 
Name | Condition Description 
Off EDPRSR.PU is 0 Core power domain is completely off, or in a low-power state where the core 
power domain registers cannot be accessed. 
Note 
If core power is off, then all external debug and memory-mapped register 
accesses return an error. 
DLK | EDPRSR.DLK is 1 OS Double Lock is locked. 
OSLK | OSLSR_EL1.OSLK is 1 OS Lock is locked. 
EDAD | AllowExternalDebugAccess() == External debug access is disabled. When an error is returned because of an 
FALSE EDAD condition code, and this is the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise SDAD is unchanged. 
SLK Memory-mapped interface only Software lock is locked. For the external debug interface, ignore this column. 
Default | - None of the conditions apply, normal access. 

















The following table shows an example of external register condition codes for access to a debug register. 
To determine the access permission for the register, scan the columns from left to right. Stop at the first 
column a condition is true, the entry gives the access permission of the register and scanning stops. 


Table 10-2 External register condition code example 





Off | DLK | OSLK | EDAD | SLK | Default 





- - - - RO/WI | RO 
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10 Debug 


10.3 AArch64 debug register summary 


The following table summarizes debug control registers that are accessible in the AArch64 execution 
state. These registers are accessed by the MRS and MSR instructions in the order of Op0, CRn, Op1, CRm, 


Op2. 


See 70.7 Memory-mapped debug register summary on page 10-397 for a complete list of registers 
accessible from the external debug interface. The 64-bit registers cover two addresses on the external 
memory interface. For those registers not described in this chapter, see the ARM” Architecture Reference 
Manual ARMv8, for ARMv8-A architecture profile. 


Table 10-3 AArch64 debug register summary 





poOjn |1 jm /|2 


Name 


Type | Reset 


Width 


Description 





OSDTRRX_EL1 


RW _ |0x00000000 


32-bit 


OS Lock Data Transfer 
Register, Receive 





DBGBVRO_EL1 


RW | @xXXXXXXXXXXXXXXXoK 


64-bit 


Debug Breakpoint Value 
Register 0 





DBGBCRO_EL1 


RW | @x@@XXXXxx"! 


32-bit 


Debug Breakpoint Control 
Register 0 


See 10.4.1 Debug Breakpoint 
Control Registers, ELI 
on page 10-384. 





DBGWVRO EL1 


RW | @xXXXXXXXXXXXXXXXoK 


64-bit 


Debug Watchpoint Value 
Register 0 





DBGWCRO EL1 


RW _ | @XXXXXXXXo™ 


32-bit 


Watchpoint Control Register 
0 


See 10.4.2 Debug Watchpoint 
Control Registers, ELI 
on page 10-386. 





DBGBVRI1 ELI 


RW | OxXXXXXXXXXXXXXXXX“K 


64-bit 


Debug Breakpoint Value 
Register 1 





DBGBCR1_EL1 


RW | @x@@XXXXXx°! 


32-bit 


Debug Breakpoint Control 
Register 1 


See 10.4.1 Debug Breakpoint 
Control Registers, ELI 
on page 10-384. 





DBGWVRI EL1 


RW | @xXXXXXXXXXXXXXXXoK 


64-bit 


Debug Watchpoint Value 
Register 1 





DBGWCRI1 EL1 


RW | @x@@XXXXXX“"™ 


32-bit 


Debug Watchpoint Control 
Register 1 


See 10.4.2 Debug Watchpoint 
Control Registers, EL] 
on page 10-386. 























MDCCINT_EL1 





RW |@0x00000000 








32-bit 





Monitor Debug Comms 
Channel Interrupt Enable 





Register 
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Table 10-3 AArch64 debug register summary (continued) 





pOin |1 |m J2 


Name 


Type | Reset 


Width 


Description 





MDSCR_EL1 


RW __ |0x00000000 


32-bit 


Monitor Debug System 
Register 





DBGBVR2_EL1 


RW | OxXXXXXXXXXXXXXXX“K 


64-bit 


Debug Breakpoint Value 
Register 2 





DBGBCR2 EL1 


RW | @x@@XXXXXxX°! 


32-bit 


Debug Breakpoint Control 
Register 2 


See 10.4.1 Debug Breakpoint 
Control Registers, EL] 
on page 10-384. 





DBGWVR2 EL1 


RW | OxXXXXXXXXXXXXXXXCK 


64-bit 


Debug Watchpoint Value 
Register 2 





DBGWCR2 EL] 


RW | @xO@XXXXXX°™ 


32-bit 


Debug Watchpoint Control 
Register 2 


See 10.4.2 Debug Watchpoint 
Control Registers, EL] 
on page 10-386. 





OSDTRTX_EL1 


RW __ |@0x00000000 


32-bit 


OS Lock Data Transfer 
Register, Transmit 





DBGBVR3_EL1 


RW | OxXXXXXXXXXXXXXXXK 


64-bit 


Debug Breakpoint Value 
Register 3 





DBGBCR3_EL1 


RW | @x@@XXXXXxX°! 


32-bit 


Debug Breakpoint Control 
Register 3 


See 10.4.1 Debug Breakpoint 
Control Registers, EL] 
on page 10-384. 





DBGWVR3_ EL1 


RW | @xXXXXXXXXXXXXXXXoK 


64-bit 


Debug Watchpoint Value 
Register 3 





DBGWCR3_EL1 


RW | @x@@XXXXXxX"! 


32-bit 


Debug Watchpoint Control 
Register 3 


See 10.4.2 Debug Watchpoint 
Control Registers, ELI 
on page 10-386. 





DBGBVR4 EL1 


RW _ | ©xXXXXXXX00000000 


64-bit 


Debug Breakpoint Value 
Register 4 





DBGBCR4 EL1 


RW | @x@OXXXXXX"" 


32-bit 


Debug Breakpoint Control 
Register 4 


See 10.4.1 Debug Breakpoint 
Control Registers, EL] 
on page 10-384. 























DBGBVRS5_EL1 





RW _ | @xXXXXXXXX80088088 








64-bit 





Debug Breakpoint Value 
Register 5 
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Table 10-3 AArch64 debug register summary (continued) 






















































































O ICR |OpICR | Op | Name Type | Reset Width | Description 

pojn |1 jm /|2 

2 |c0 |O |c5 |5 | DBGBCRS_EL1 RW | @x@@XXXXXX°" 32-bit | Debug Breakpoint Control 
Register 5 
See 10.4.1 Debug Breakpoint 
Control Registers, EL] 
on page 10-384. 

2 |c0 |O |c6 |2 |OSECCR_EL1 RW | 0xeeee0000 32-bit | OS Lock Exception Catch 
Control Register 

2 |c0 |3 |cel |0 |MDCCSR_ELO RO |@0x00000000 32-bit | Monitor Debug Comms 
Channel Status Register 

2 |c0 |3 |c4 |0 |DBGDTR_ELO RW |@0x0000000000000000 64-bit | Debug Data Transfer 
Register, half-duplex 

2 Įc0 |3 |c5 |0 |DBGDTRTX_ELO WO |- 32-bit | Debug Data Transfer 
Register, Transmit, Internal 
View 

2 {c0 |3 |c5 |0 |DBGDTRRX_ELO RO 0x00000000 32-bit | Debug Data Transfer 
Register, Receive, Internal 
View 

2 {c0 |4 |c7 |0 | DBGVCR32_EL2 RW | 0xeeee0000 32-bit | Debug Vector Catch Register 

2 fcl |O |cO |O |MDRAR ELl RO |° 64-bit | Debug ROM Address 
Register 

2 fcl |O |cO |4 |OSLAR_EL1 WO |- 32-bit | Debug OS Lock Access 
Register 

2 fcl |O fcl |4 |OSLSR_EL1 RO |@x0000000A 32-bit | Debug OS Lock Status 
Register 

2 Įcl J0 |c3 |4 |OSDLR_EL1 RW |©0x00000000 32-bit | Debug OS Double Lock 
Register 

2 |cl [O0 |c4 |4 |DBGPRCR ELI RW |P 32-bit | Debug Power/Reset Control 
Register 

2 |c7 |O |c8 |6 |DBGCLAIMSET ELI RW |@0x000000FF 32-bit | Debug Claim Tag Set 
Register 

2 |c7 |O |c9 |6 |DBGCLAIMCLR EL1 RW | 0xeeee0000 32-bit | Debug Claim Tag Clear 
Register 

2 |c7 |O |cl4 |6 |DBGAUTHSTATUS_ELI |RO OxX00O0OOAA!I 32-bit | Debug Authentication Status 
Register 

ck 





co 
cp 
cq 


The actual reset value is {62 {1'bx} },2'b0. 
The actual reset value is 32'b000000000x0x0x0xxxx0000xxxx00xx0. 
The actual reset value is 32'bO000xxxxx000x0xOxxxxxXXXXXXXXXXXX0. 
The actual reset value is 32'bO0000000xxxx0x0xxxx0000xxxx00xx0. 
Resets to the physical address of the ROM table +3. 
The actual reset value is 3 1'b60000000000000000000000000000,EDPRCR.COREPURQ. 
The actual reset value is 24'h000000,1'b1,(DBGEN | NIDEN) & (SPIDEN | SPNIDEN),1'b1,DBGEN & SPIDEN, |'b1,DBGEN | NIDEN,1'b1,DBGEN. 
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10.4 AArch64 debug register descriptions 
This section describes the debug registers in AArch64 state. 


10.3 AArch64 debug register summary on page 10-381 provides cross-references to the individual 
registers. 


This section contains the following subsections: 
e 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-384. 
¢ 10.4.2 Debug Watchpoint Control Registers, ELI on page 10-386. 


10.4.1 Debug Breakpoint Control Registers, EL1 
The DBGBCRn_ELI characteristics are: 


Purpose Holds control information for a breakpoint. Each DBGBVR_ ELI is associated with 
a DBGBCR_ELI to form a Breakpoint Register Pair (BRP). DBGBVRn_EL] is 
associated with DBGBCRn_EL1 to form BRPn. 


Note 
The range of breakpoint number n, for DBGBCRu_EL! is 0 to 5. 














Usage These registers are accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW |RW | RW | RW RW 























Configurations © DBGBCRn_EL]I are architecturally mapped to: 
e The AArch32 DBGBCRz registers. 
e The external DBGBCRv_ ELI registers. 


Attributes DBGBCRn_EL1 is a 32-bit register. 
The debug logic reset value of a DBGBCRn_EL1 is UNKNOWN. 


The following figure shows the DBGBCRu_EL1 bit assignments. 


31 24 23 20 19 16 15 14 13 12 5 43 2 1 0 


Figure 10-2 DBGBCRn_EL1 bit assignments. 
The following table shows the DBGBCRn_ELI bit assignments. 
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Table 10-4 DBGBCRn_EL1 bit assignments 





Bits 


Name 


Function 





[31:24] 


Reserved, RESO. 





[23:20] 


BT 


Breakpoint Type. This field controls the behavior of breakpoint debug event generation. This includes the meaning 
of the value held in the associated DBGBVR, indicating whether it is an instruction address match or mismatch or a 
Context match. It also controls whether the breakpoint is linked to another breakpoint. The possible values are: 
@beeee Unlinked instruction address match. 

@beee1 Linked instruction address match. 

0b0010 Unlinked ContextIDR match. 

0b0011 Linked ContextIDR match. 

0b0100 Unlinked instruction address mismatch. 

@be101 Linked instruction address mismatch. 

0b1000 Unlinked VMID match. 

0b1001 Linked VMID match. 

0b1010 Unlinked VMID + CONTEXTIDR match. 

0b1011 Linked VMID + CONTEXTIDR match. 





All other values are reserved. 
The field break down is: 
¢ BT[2] and BT[0] are available for all BRPs and are read/write. 
Note 
BT[0], (BCR[20]) sets LBN[2] (BCR[18]) 








¢ BT[3] and BT[1] are only available for context-aware breakpoints (BRP 4 and 5) 





[19:16] 


LBN 


Linked Breakpoint Number. For Linked address matching breakpoints, this specifies the index of the Context- 
matching breakpoint linked to. 

It is only possible to link to context-aware breakpoints. 

e LBN[0] is read/write. 

e LBN[1] and LBN[3] are RESO. 

e LBN[2] is mapped to BT[0] which is read/write. 





[15:14] 


SSC 


Security State Control. Determines the Security states under which a breakpoint debug event for a breakpoint n is 
generated. 


This field must be interpreted with the HMC and PMC fields to determine the mode and Security states that can be 
tested. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for possible values of the 
fields. 





[13] 


HMC 


Higher Mode Control. Determines the debug perspective for deciding when a breakpoint debug event for breakpoint 
n is generated. 


This bit must be interpreted with the SSC and PMC fields to determine the mode and Security states that can be 
tested. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for possible values of the 
fields. 





[12:9] 











Reserved, RESO. 
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Table 10-4 DBGBCRn_EL1 bit assignments (continued) 





Bits Name | Function 





[8:5] | BAS‘ | Byte Address Select. Defines which half-words an address-matching breakpoint matches, regardless of the 
instruction set and Execution state. A debugger must program this field as follows: 


0x3 Match the T32 instruction at DBGBVRn. 
@xC Match the T32 instruction at DBGBVRn+2. 
OxF Match the A64 or A32 instruction at DBGBVRn, or context match. 


All other values are reserved. 
Note 
The ARMv8-A architecture does not support direct execution of Java bytecodes. BAS[3] and BAS[1] ignore writes 





and on reads return the values of BAS[2] and BAS[0] respectively. 








[4:3] |- Reserved, RESO. 





[2:1] |PMC_ | Privileged Mode Control. Determines the Exception level or levels that a breakpoint debug event for breakpoint n is 
generated. 


This field must be interpreted with the SSC and HMC fields to determine the mode and Security states that can be 
tested. 


See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for possible values of the 
fields. 





Note 


Bits[2:1] have no effect for accesses made in Hyp mode. 





[0] E Enable Breakpoint. This bit enables the BRP: 
(2 BRP disabled. 
1 BRP enabled. 


A BRP never generates a breakpoint debug event when it is disabled. 
Note 
DBGBCR.E is reset on cold reset, using nCPUPORESET. 























To access the DBGBCRn_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, DBGBCRn_EL1; Read Debug Breakpoint Control Register n 
MSR DBGBCRn_EL1, <Xt>; Write Debug Breakpoint Control Register n 


To access the DBGBCRza in AArch32 state, read or write the CP14 register with: 


MRC p14, ©, <Rt>, c@, cn, 4; Read Debug Breakpoint Control Register n 
MCR p14, ©, <Rt>, c@, cn, 4; Write Debug Breakpoint Control Register n 


The DBGBCRn_EL]1 can be accessed through the external debug interface, offset @x4n8. 


10.4.2 Debug Watchpoint Control Registers, EL1 
The DBGWCRzu_ELI characteristics are: 





Cr See the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A architecture profile for more information on how the BAS field is interpreted by hardware. 
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Purpose Holds control information for a watchpoint. Each DBGWCR_ELI is associated with 
a DBGWVR ELI to form a Watchpoint Register Pair (WRP). DBGWCRn_ELI is 
associated with DBGWVRn_ELI to form WRPn. 


Note 
The range of watchpoint number n for DBGWCRn_EL! is 0 to 3. 














Usage These registers are accessible as follows: 
constraints 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- RW IRW |RW | RW RW 























Configurations The DBGWCRn_ ELI! is architecturally mapped to: 


e The AArch32 DBGWCRaz registers. 
e The external DBGWCRnu_ELI registers. 


Attributes DBGWCRzn_ EL] is a 32-bit register. 
The debug logic reset value of a DBGWCR_ELI is UNKNOWN. 


The following figure shows the DBGWCRn_ELI bit assignments. 


29 28 2423 212019 1615 14 13 12 5432 1 
L_wt L_HMC 


Figure 10-3 DBGWCRn_EL1 bit assignments 
The following table shows the DBGWCRn_ ELI bit assignments. 


Table 10-5 DBGWCRn_EL1 bit assignments 
































Bits | Name | Function 
[31:29] | - Reserved, RESO. 
[28:24] | MASK | Address Mask. Only objects up to 2GB can be watched using a single mask. 
@beeee0 No mask. 
@beee01 Reserved. 
0b00010 Reserved. 
Other values mask the corresponding number of address bits, from 0b00011 masking three address bits 
(0x00000007 mask for address) to 9611111 masking 31 address bits (@x7FFFFFFF mask for address). 
[23:21] | - Reserved, RESO. 
[20] WT Watchpoint Type. Possible values are: 
(2 Unlinked data address match. 
1 Linked data address match. 
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Table 10-5 DBGWCRn_EL1 bit assignments (continued) 





Bits 


Name | Function 





[19:16] 


LBN 


Linked Breakpoint Number. For Linked data address watchpoints, this specifies the index of the Context-matching 
breakpoint linked to. 

It is only possible to link to context-aware breakpoints. 

e LBN[0] is read/write. 

e LBN[1] and LBN[3] are REso. 

e LBN[2] is mapped to WT[0] which is read/write. 


See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 





[15:14] 


SSC 


Security State Control. Determines the Security states under which a watchpoint debug event for watchpoint n is 
generated. This field must be interpreted along with the HMC and PAC fields. 


See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 





[13] 


HMC 


Higher Mode Control. Determines the debug perspective for deciding when a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the SSC and PAC fields. 


See the ARM” Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 





[12:5] 


BAS 


Byte Address Select. Each bit of this field selects whether a byte from within the word or doubleword addressed by 
DBGWVRn_EL1 is being watched. 


See the ARM” Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 





[4:3] 


LSC 


Load/Store Control. This field enables watchpoint matching on the type of access being made. Possible values of 
this field are: 


@be1 Match instructions that load from a watchpointed address. 
b10 Match instructions that store to a watchpointed address. 


@b11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. 





[2:1] 


PAC 


Privilege of Access Control. Determines the Exception level or levels at which a watchpoint debug event for 
watchpoint n is generated. This field must be interpreted together with the SSC and HMC fields. 


See the ARM® Architecture Reference Manual ARMv6, for ARMv8-A architecture profile for more information. 





[0] 








Enable Watchpoint n. Possible values are: 


7) Watchpoint disabled. 
1 Watchpoint enabled. 





Note 
DBGBCR.E is reset on cold reset, using nCPUPORESET. 











To access the DBGWCRn_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, DBGWCRn_EL1; Read Debug Watchpoint Control Register n 
MSR DBGWCRn_EL1, <Xt>; Write Debug Watchpoint Control Register n 


To access the DBGWCRzu in AArch32 state, read or write the CP 14 register with: 


MRC p14, ©, <Rt>, c@, cn, 7; Read Debug Watchpoint Control Register n 
MCR p14, ©, <Rt>, c0, cn, 7; Write Debug Watchpoint Control Register n 


The DBGWCRzv_ELI can be accessed through the external debug interface, offset @x8n8. 
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10.5 AArch32 debug register summary 
The following table summarizes the 32-bit and 64-bit debug control registers that are accessible in the 
AArch32 Execution state from the internal CP 14 interface. These registers are accessed by the MCR and 
MRC instructions in the order of CRn, op2, CRm, Op! or MCRR and MRRC instructions in the order of CRm, 
Opl. 
For those registers not described in this chapter, see the ARM® Architecture Reference Manual ARMv8, 
for ARMv8-A architecture profile. See the 10.7 Memory-mapped debug register summary 
on page 10-397 for a complete list of registers accessible from the external debug interface. 
Table 10-6 AArch32 debug register summary 
CRn |Op2 CRm |Op1 Name Type | Reset Description 
c0 0 c0 0 DBGDIDR RO 0x3516D000 10.6.1 Debug ID Register 
on page 10-393 
c0 0 cl 0 DBGDSCRint RO 0x000X0000°: Debug Status and Control 
Register, Internal View 
c0 0 c2 0 DBGDCCINT RW 0x00000000 Debug Comms Channel 
Interrupt Enable Register 
c0 0 c5 0 DBGDTRTXint WO - Debug Data Transfer 
Register, Transmit, 
Internal View 
c0 0 c5 0 DBGDTRRXint RO 0x00000000 Debug Data Transfer 
Register, Receive, 
Internal View 
c0 0 c6 0 DBGWFAR* RW - Watchpoint Fault Address 
Register, RESO 
c0 0 c7 0 DBGVCR RW 0x00000000 Debug Vector Catch 
Register 
c0 2 c0 0 DBGDTRRXext RW 0x00000000 Debug Data Transfer 
Register, Receive, 
External View 
c0 2 c2 0 DBGDSCRext RW 0x000X0000"S Debug Status and Control 
Register, External View 
c0 2 c3 0 DBGDTRTXext RW 0x00000000 Debug Data Transfer 
Register, Transmit, 
External View 
c0 2 c6 0 DBGOSECCR RW 0x00000000 Debug OS Lock 
Exception Catch Control 
Register 
c0 4 c0 0 DBGBVRO RW OxXXXXXXXU Debug Breakpoint Value 
Register 0 
c0 4 cl 0 DBGBVR1 RW OxXXXXXXXXo" Debug Breakpoint Value 
Register 1 
c0 4 c2 0 DBGBVR2 RW OXXXXXXXX®" Debug Breakpoint Value 
Register 2 
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Table 10-6 AArch32 debug register summary (continued) 

















CRn | Op2 CRm | Op1 Name Type | Reset Description 

c0 4 c3 0 DBGBVR3 RW OXXXXXXXX"" Debug Breakpoint Value 
Register 3 

c0 4 c4 0 DBGBVR4 RW OxXXXXXXX“"U Debug Breakpoint Value 
Register 4 

c0 4 c5 0 DBGBVR5 RW OxXXXXXXXX“" Debug Breakpoint Value 
Register 5 

c0 2) c0 0 DBGBCRO RW O@x@OXXXXXX°V Debug Breakpoint 
Control Register 0 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 





c0 5 cl 0 DBGBCR1 RW O@x@OXXXXXX°V Debug Breakpoint 
Control Register 1 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 





c0 5 c2 0 DBGBCR2 RW O@x@OXXXXXX°V Debug Breakpoint 
Control Register 2 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 





c0 5 c3 0 DBGBCR3 RW O@x@OXXXXXX°V Debug Breakpoint 
Control Register 3 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 





c0 > c4 0 DBGBCR4 RW Q@x@OXXXXXX°” Debug Breakpoint 
Control Register 4 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 





c0 5 c5 0 DBGBCRS RW OXOOXXXXXX®W Debug Breakpoint 
Control Register 5 


See 10.4.1 Debug 
Breakpoint Control 
Registers, ELI 

on page 10-384. 






































c0 6 c0 0 DBGWVRO RW @xXXXXXXXX“" Debug Watchpoint Value 
Register 0 
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Table 10-6 AArch32 debug register summary (continued) 





CRn |Op2 CRm |Op1 Name Type | Reset Description 





c0 6 cl 0 DBGWVRI RW OxXXXXXXXoU Debug Watchpoint Value 


Register 1 





c0 6 c2 0 DBGWVR2 RW OXXXXXXXX®" Debug Watchpoint Value 


Register 2 





c0 6 c3 0 DBGWVR3 RW OXXXXXXXX“" Debug Watchpoint Value 


Register 3 





c0 7 c0 0 DBGWCRO RW O@XXXXXXXX°* Watchpoint Control 


Register 0 


See 10.4.2 Debug 
Watchpoint Control 
Registers, ELI 

on page 10-386. 





c0 T cl 0 DBGWCRI1 RW O@xXXXXXXXX* Watchpoint Control 


Register 1 


See 10.4.2 Debug 
Watchpoint Control 
Registers, ELI 

on page 10-386. 





c0 7 c2 0 DBGWCR2 RW O@xXXXXXXXX°* Watchpoint Control 


Register 2 


See 10.4.2 Debug 
Watchpoint Control 
Registers, ELI 

on page 10-386. 





c0 7 c3 0 DBGWCR3 RW O@XXXXXXXX* Watchpoint Control 


Register 3 


See 10.4.2 Debug 
Watchpoint Control 
Registers, ELI 

on page 10-386. 





cl 0 c0 


DBGDRAR[31:0] RO cy 





DBGDRAR[63:0] RO 7 


Debug ROM Address 
Register 





DBGBXVR4 RW | @xXXXXXXxX“8 


Debug Breakpoint 
Extended Value Register 
4 





cl 1 c5 


DBGBXVR5 RW @xXXXXXXXX4a 


Debug Breakpoint 
Extended Value Register 
5 





cl 4 c0 


DBGOSLAR WO - 


Debug OS Lock Access 
Register 





cl 4 cl 

















DBGOSLSR RO Qx0008800A 











Debug OS Lock Status 
Register 








ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 
reserved. 
Non-Confidential 


10-391 





10 Debug 


10.5 AArch32 debug register summary 


Table 10-6 AArch32 debug register summary (continued) 




































































CRn |Op2 |CRm | Op1 Name Type | Reset Description 
cl 4 c3 0 DBGOSDLR RW 0x00000000 Debug OS Double Lock 
Register 
cl 4 c4 0 DBGPRCR RW |e Debug Power/Reset 
Control Register 
c2 2 c0 0 DBGDSAR[31:0] RO - Debug Self Address 
Register RESO 
P 0 c2 z DBGDSAR[63:0]“ RO l- B 
c7 J c0 0 DBGDEVID2 RO 0x00000000 Debug Device ID 
Register 2, RESO 
c7 T cl 0 DBGDEVID1 RO 0x00000002 10.6.3 Debug Device ID 
Register 1 
on page 10-395 
c7 T c2 0 DBGDEVID RO 0x00110F13 10.6.2 Debug Device ID 
Register on page 10-394 
c7 6 c8 0 DBGCLAIMSET RW 0x00000OF F Debug Claim Tag Set 
Register 
c7 6 c9 0 DBGCLAIMCLR RW 0x00000000 Debug Claim Tag Clear 
Register 
c7 6 cl4 JO DBGAUTHSTATUS RO |Əxogooooaati Debug Authentication 
Status Register 
cS The actual reset value is 32'b0000000000000xxx0000000000000000. 
ct Previously returned information about the address of the instruction that accessed a watchpoint address. This register is now deprecated and is RESO. 
CU The actual reset value is {30 {1'bx}},2'b0 
CV The actual reset value is 32'b000000000x0x0x0xxxx0000xxxx00xx0. 
CW The actual reset value is 32'b00000000xxxx0x0xxxx0000xxxx00xx0. 
CX The actual reset value is 32'b000xxxxx000x0x0xxxxXXXXXXXXXXXX0. 
CY The actual reset value is ROMADDR[31:12],10'b0000000000, {2{ROMADDRV}}. 
CZ The actual reset value is 0x000000,ROMADDR[39:12], 10'b0000000000, {2{ROMADDRV}}. 
da The actual reset value is 32"HxXXXXXxxx. 
db The actual reset value is 31'b0000000000000000000000000000,EDPRCR.COREPURQ. 
de Previously defined the offset from the base address defined in DBGDRAR of the physical base address of the debug registers for the processor. This register is now 
deprecated and RESO. 
dd The actual reset value is 24'h000000, 1'b1,(DBGEN | NIDEN) & (SPIDEN | SPNIDEN),1'b1,DBGEN & SPIDEN,|'b1,DBGEN | NIDEN,1'b1,DBGEN. 
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10.6 AArch32 debug register descriptions 
This section describes the debug registers in AArch32 state. 
10.5 AArch32 debug register summary on page 10-389 provides cross-references to the individual 
registers. 
This section contains the following subsections: 
e 10.6.1 Debug ID Register on page 10-393. 
e 10.6.2 Debug Device ID Register on page 10-394. 
e 10.6.3 Debug Device ID Register 1 on page 10-395. 
10.6.1 Debug ID Register 
The DBGDIDR characteristics are: 
Purpose Specifies: 
e The version of the Debug architecture. 
e Some features of the debug implementation. 
Usage constraints This register is accessible as follows: 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RO IRO |RO [RO |RO |RO RO 
Configurations There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes DBGDIDR is a 32-bit register. 
The following figure shows the DBGDIDR bit assignments. 
28 27 24 23 20 19 16 15 14 13 12 11 0 
pmo poll] = 
RES1 =] | L s 
nSUHD_imp RESO 
Figure 10-4 DBGDIDR bit assignments 
The following table shows the DBGDIDR bit assignments. 
Table 10-7 DBGDIDR bit assignments 
Bits |Name Function 
[31:28] | WRPs The number of Watchpoint Register Pairs (WRPs) implemented, minus one. This value is: 
0x3 Four WRPs are implemented. 
This field has the same value as ID_AA64DFR0_EL1.WRPs. 
[27:24] | BRPs The number of Breakpoint Register Pairs (BRPs) implemented, minus one. This value is: 
0x5 Six BRPs are implemented. 
This field has the same value as ID AA64DFRO_EL1.BRPs. 
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Table 10-7 DBGDIDR bit assignments (continued) 





Bits Name Function 





[23:20] | CTX_CMPs | The number of BRPs that can be used for Context matching, minus one. This value is: 


@x1 Two Context matching breakpoints, breakpoints 4 and 5, are implemented. 


This field has the same value as ID AA64DFRO_EL1.CTX_CMPs. 





[19:16] | Version The Debug architecture version. 


0x6 ARMv8, v8 Debug architecture is implemented. 





[15] - Reserved, RES1. 





[14] nSUHD_imp | The value of this bit must match the value of SE_imp. This value is: 








1 The value of SE imp is 1 
[13] - Reserved, RES0. 
[12] SE_imp EL3 implemented. The value is: 


1 EL3 is implemented. 








[11:0] Reserved, RESO. 











To access the DBGDIDR in AArch32 state, read the CP 14 register with: 


MRC p14, ©, <Rt>, c0, c@, ©; Read Debug ID Register 


10.6.2 Debug Device ID Register 
The DBGDEVID characteristics are: 


Purpose Adds to the information given by the DBGDIDR by describing other features of the 
debug implementation. 


Usage constraints This register is accessible as follows: 








ELO | ELO|EL1 | EL1/EL2|EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- |- [RO |RO ÍRO [RO RO 


























Configurations There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes DBGDEVID is a 32-bit register. 


The following figure shows the DBGDEVID bit assignments. 


28 27 24 23 20 19 16 15 12 11 


i L_weaddrMask 
BPAddrMask 


VectorCatch 


Figure 10-5 DBGDEVID bit assignments 
The following table shows the DBGDEVID bit assignments. 
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Table 10-8 DBGDEVID bit assignments 





















































Bits /Name Function 

[31:28] | CIDMask Indicates the level of support for the Context ID matching breakpoint masking capability. This value is: 
0x® Context ID masking is not implemented. 

[27:24] | AuxRegs Indicates support for Auxiliary registers. This value is: 
0x® None supported. 

[23:20] | DoubleLock | Indicates the presence of the DBGOSDLR, OS Double Lock Register. This value is: 
@x1 The DBGOSDLR is present. 

[19:16] | VirtExtns Indicates whether EL2 is implemented. This value is: 
0x1 EL2 is implemented. 

[15:12] | VectorCatch | Defines the form of Vector catch debug event implemented. This value is: 
0x0 Address matching vector catch debug event implemented. 

[11:8] | BPAddrMask | Indicates the level of support for the Immediate Virtual Address (IVA) matching breakpoint masking 
capability. This value is: 
OxF Breakpoint address masking is not implemented. DBGBCRn[28:24] is RESO. 

[7:4] WPAddrMask | Indicates the level of support for the data VA matching watchpoint masking capability. This value is: 
0x1 Watchpoint address mask implemented. 

[3:0] PCSample Indicates the level of Sample-based profiling support using external debug registers 40 through 43. This value 
is: 
0x3 EDPCSR, EDCIDSR and EDVIDSR are implemented as debug registers 40, 41, and 42. 

To access the DBGDEVID in AArch32 state, read the CP14 register with: 
MRC p14, ©, <Rt>, c7, c2, 7; Read Debug Device ID Register @ 
10.6.3 Debug Device ID Register 1 


The DBGDEVID1 characteristics are: 


Purpose 


debug implementation. 


Usage constraints This register is accessible as follows: 


Adds to the information given by the DBGDIDR by describing other features of the 
































ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 

(NS) |(S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 

- - RO |RO [RO |RO RO 
Configurations There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes DBGDEVID1 is a 32-bit register. 


The following figure shows the DBGDEVIDI register bit assignments. 
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31 


PCSROffset zal 
Figure 10-6 DBGDEVID1 bit assignments 


The following table shows the DBGDEVID1 register bit assignments. 
Table 10-9 DBGDEVID1 bit assignments 





Bits |Name 


Function 





[31:4] | - 


Reserved, RESO. 





[3:0] | PCSROffset | Indicates the offset applied to PC samples returned by reads of EDPCSR. The value is: 





0x2 EDPCSR is implemented and samples have no offset applied and do not sample the instruction set 
state in AArch32 state. 











To access the DBGDEVID1 register in AArch32 state, read the CP14 register with: 


MRC p14, ©, <Rt>, c7, c1, 47 Read Debug Device ID Register 1 
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10.7 Memory-mapped debug register summary 

The following table shows the offset address for the registers that are accessible from the external debug 

interface. 

For those registers not described in this chapter, see the ARM" Architecture Reference Manual ARMV8, 

for ARMv8-A architecture profile. 

Table 10-10 Memory-mapped debug register summary 
Offset Name Type | Width | Description 
@x@00-OxO1C | - - - Reserved 
0x020 EDESR RW | 32-bit | External Debug Event Status Register 
0x024 EDECR RW |32-bit | External Debug Execution Control Register 
0x028-0x02C | - - - Reserved 
0x030 EDWAR[31:0] RO | 64-bit | External Debug Watchpoint Address Register 
0x034 EDWAR[63:32] 
0x038 -0x07C | - - - Reserved 
0x080 DBGDTRRX_ELO RW | 32-bit | Debug Data Transfer Register, Receive 
0x084 EDITR WO |32-bit | External Debug Instruction Transfer Register 
0x088 EDSCR RW |32-bit | External Debug Status and Control Register 
@x@8C DBGDTRTX_ELO RW _ | 32-bit | Debug Data Transfer Register, Transmit 
0x090 EDRCR WO |32-bit | 10.8.1 External Debug Reserve Control Register on page 10-401 
0x098 EDECCR RW |32-bit | External Debug Exception Catch Control Register 
@x@9C - - 32-bit | Reserved 
@x0@AQ EDPCSRlo RO | 32-bit | External Debug Program Counter Sample Register, low word 
Ox0A4 EDCIDSR RO | 32-bit | External Debug Context ID Sample Register 
@x@A8 EDVIDSR RO | 32-bit | External Debug Virtual Context Sample Register 
@x@AC EDPCSRhi RO | 32-bit | External Debug Program Counter Sample Register, high word 
@x@BO-Ox2FC | - - - Reserved 
0x300 OSLAR_EL1 WO _ | 32-bit | OS Lock Access Register 
@x304-Ox3@C | - - - Reserved 
0x310 EDPRCR RW |32-bit | External Debug Power/Reset Control Register 
0x314 EDPRSR RO | 32-bit | External Debug Processor Status Register 
0x318-0x3FC | - - - Reserved 
0x400 DBGBVRO0_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 0 
0x404 DBGBVRO_EL1[63:32] 
0x408 DBGBCRO0_EL1 RW |32-bit | Debug Breakpoint Control Register 0 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x4@C = = - Reserved 
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Table 10-10 Memory-mapped debug register summary (continued) 
















































































Offset Name Type | Width | Description 

0x410 DBGBVR1_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 1 

0x414 DBGBVR1_EL1[63:32] 

0x418 DBGBCR1_EL1 RW |32-bit | Debug Breakpoint Control Register 1 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x41C - - - Reserved 

0x420 DBGBVR2_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 2 

0x424 DBGBVR2_EL1[63:32] 

0x428 DBGBCR2_EL1 RW | 32-bit | Debug Breakpoint Control Register 2 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x42C - - - Reserved 

0x430 DBGBVR3_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 3 

0x434 DBGBVR3_EL1[63:32] 

0x438 DBGBCR3_EL1 RW |32-bit | Debug Breakpoint Control Register 3 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x43C - - - Reserved 

0x440 DBGBVR4_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 4 

0x444 DBGBVR4_EL1[63:32] 

0x448 DBGBCR4 EL1 RW | 32-bit | Debug Breakpoint Control Register 4 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x44C - - - Reserved 

0x450 DBGBVR5_EL1[31:0] RW | 64-bit | Debug Breakpoint Value Register 5 

0x454 DBGBVR5_EL1[63:32] 

0x458 DBGBCR5_EL1 RW |32-bit | Debug Breakpoint Control Register 5 
See 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-384. 

@x45C-Ox7FC | - - - Reserved 

0x800 DBGWVRO0_EL1[31:0] RW |64-bit | Debug Watchpoint Value Register 0 

0x804 DBGWVRO_EL1[63:32] 

0x808 DBGWCRO0_EL1 RW |32-bit | Debug Watchpoint Control Register 0 
See 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-386. 

@x8@C = - - Reserved 
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Table 10-10 Memory-mapped debug register summary (continued) 





































































































Offset Name Type | Width | Description 
0x810 DBGWVR1_EL1[31:0] RW | 64-bit | Debug Watchpoint Value Register 1 
0x814 DBGWVR1_EL1[63:32] 
0x818 DBGWCRI1_EL1 RW |32-bit | Debug Watchpoint Control Register 1 
See 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-386. 
@x81C - - - Reserved 
0x820 DBGWVR2_EL1[31:0] RW | 64-bit | Debug Watchpoint Value Register 2 
0x824 DBGWVR2_EL1[63:32] 
0x828 DBGWCR2_EL1 RW |32-bit | Debug Watchpoint Control Register 2 
See 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-386. 
@x82C - - - Reserved 
0x830 DBGWVR3_EL1[31:0] RW | 64-bit | Debug Watchpoint Value Register 3 
0x834 DBGWVR3_EL1[63:32] 
0x838 DBGWCR3_EL1 RW |32-bit | Debug Watchpoint Control Register 3 
See 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-386. 
@x83C-@xCFC | - - - Reserved 
oxD0O MIDR RO | 32-bit | 4.3.1 Main ID Register, ELI on page 4-81 
@xD@4-@xD1C | - - - Reserved 
@xD20 ID_AA64PFRO_EL1[31:0] RO | 64-bit | 4.3.19 AArch64 Processor Feature Register 0 on page 4-104 
@xD24 ID_AA64PFRO_EL1[63:32] 
@xD28 ID_AA64DFRO_EL1[31:0] RO | 64-bit | 4.3.21 AArch64 Debug Feature Register 0, EL1 on page 4-106 
@xD2C ID_AA64DFRO_EL1[63:32] 
@xD30 ID_AA64ISARO_EL1[31:0] RO | 64-bit | 4.3.25 AArch64 Instruction Set Attribute Register 0, EL1 
exD34 ID_AA64ISARO_EL1[63:32] eevee nt 
@xD38 ID_AA64MMFRO_EL1[31:0] | RO | 64-bit | 4.3.27 AArch64 Memory Model Feature Register 0, EL1 
@xD3C ID_AA64MMFRO.EL1[63:32] apenas 
0xD40 ID_AA64PFR1_EL1[31:0] RO | 64-bit | Processor Feature Register 1, RESO 
@xD44 ID_AA64PFR1_EL1[63:32] 
@xD48 ID_AA64DFR1_ EL1[31:0] RO | 64-bit | Debug Feature Register 1, RESO 
@xD4C ID_AA64DFR1_EL1[63:32] 
@xD590 ID_AA64ISAR1_EL1[31:0] RO | 64-bit | Instruction Set Attribute Register 1 low word, RESO 
@xD54 ID_AA64ISARI_EL1[63:32] 
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Table 10-10 Memory-mapped debug register summary (continued) 































































































Offset Name Type | Width | Description 

@xD58 ID_AA64MMFR1_EL1[31:0] | RO | 64-bit | Memory Model Feature Register 1 low word, RESO 

@xD5C ID_AA64MMFR1_EL1[63:32] 

@xD60-OxEFC | - - - Reserved 

@xF@4-OxF9C | - - - Reserved 

OxFAO DBGCLAIMSET EL1 RW | 32-bit | Debug Claim Tag Set Register 

OxFA4 DBGCLAIMCLR ELI RW | 32-bit | Debug Claim Tag Clear Register 

OxFA8 EDDEVAFFO0O RO | 32-bit | External Debug Device Affinity Register 0 

@xFAC EDDEVAFF1 RO | 32-bit | External Debug Device Affinity Register 1, RESO 

OxFBO EDLAR WO | 32-bit | External Debug Lock Access Register 

OxFB4 EDLSR RO | 32-bit | External Debug Lock Status Register 

OxFB8 DBGAUTHSTATUS_EL1 RO | 32-bit | Debug Authentication Status Register 

@xFBC EDDEVARCH RO | 32-bit | External Debug Device Architecture Register 

@xFCO EDDEVID2 RO | 32-bit | External Debug Device ID Register 2, RESO 

@xFC4 EDDEVID1 RO | 32-bit | 10.8.3 External Debug Device ID Register 1 on page 10-402 

@xFC8 EDDEVID RO | 32-bit | 10.8.2 External Debug Device ID Register 0 on page 10-402 

@xFCC EDDEVTY PE RO | 32-bit | External Debug Device Type Register 

@xFDO EDPIDR4 RO | 32-bit | External Debug Peripheral Identification Register 4 
on page 10-406 

@xFD4-@xFDC | EDPIDRS-7 RO | 32-bit | External Debug Peripheral Identification Register 5-7 
on page 10-407 

OxFEO EDPIDRO RO | 32-bit | External Debug Peripheral Identification Register 0 
on page 10-404 

OxFE4 EDPIDR1 RO | 32-bit | External Debug Peripheral Identification Register 1 
on page 10-404 

OxFE8 EDPIDR2 RO |32-bit | External Debug Peripheral Identification Register 2 
on page 10-405 

@xFEC EDPIDR3 RO | 32-bit | External Debug Peripheral Identification Register 3 
on page 10-405 

OxFFO EDCIDRO RO | 32-bit | External Debug Component Identification Register 0 
on page 10-407 

OxFF4 EDCIDR1 RO | 32-bit | External Debug Component Identification Register 1 
on page 10-408 

OxFF8 EDCIDR2 RO | 32-bit | External Debug Component Identification Register 2 
on page 10-408 

@xFFC EDCIDR3 RO | 32-bit | External Debug Component Identification Register 3 


on page 10-409 
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10.8 Memory-mapped debug register descriptions 
This section describes the Cortex-A73 processor debug registers. 
10.7 Memory-mapped debug register summary on page 10-397 provides cross-references to the 
individual registers. 
This section contains the following subsections: 
¢ 10.8.1 External Debug Reserve Control Register on page 10-401. 
e 10.8.2 External Debug Device ID Register 0 on page 10-402. 
¢ 10.8.3 External Debug Device ID Register 1 on page 10-402. 
¢ 10.8.4 External Debug Peripheral Identification Registers on page 10-403. 
¢ 10.8.5 External Debug Component Identification Registers on page 10-407. 
10.8.1 External Debug Reserve Control Register 
The EDRCR characteristics are: 
Purpose This register is used to allow imprecise entry to Debug state and clear sticky bits in 
EDSCR. 
This register is part of the Debug registers functional group. 
Usage constraints This register is accessible as follows: 
Off |DLK | OSLK | SLK | Default 
Error | Error | Error | WI | WO 
Configurations EDRCR is in the Core power domain. 
Attributes EDRCR is a 32-bit register. 
The following figure shows the EDRCR bit assignments. 
31 4321 0 
mm l 
CSPA | 
CSE 
Figure 10-7 EDRCR bit assignments 
The following table shows the EDRCR bit assignments. 
Table 10-11 EDRCR bit assignments 
Bits | Name | Function 
[31:4] | - Reserved, RESO. 
[3] CSPA | Clear Sticky Pipeline Advance. This bit is used to clear the EDSCR.PipeAdv bit to @. The actions on writing to this 
bit are: 
7) No action. 
1 Clear the EDSCR.PipeAdv bit to @. 
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Table 10-11 EDRCR bit assignments (continued) 





Bits | Name | Function 





[2] CSE |Clear Sticky Error. Used to clear the EDSCR cumulative error bits to @. The actions on writing to this bit are: 


[2] No action. 
1 Clear the EDSCR.{TXU, RXO, ERR} bits, and, if the core is in Debug state, the EDSCR.ITO bit, to @. 

















[1:0] Reserved, RESO. 





The EDRCR can be accessed through the external debug interface, offset 0x099. 


10.8.2 External Debug Device ID Register 0 
The EDDEVID register characteristics are: 


Purpose Provides extra information for external debuggers about features of the debug 
implementation. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























ao Je ile z - [RO 
Configurations The EDDEVID register is in the Debug power domain. 
Attributes EDDEVID is a 32-bit register. 
The following figure shows the EDDEVID bit assignments. 
31 28 27 24 23 4 3 0 


Figure 10-8 EDDEVID bit assignments 
The following table shows the EDDEVID bit assignments. 


Table 10-12 EDDEVID bit assignments 





Bits Name Function 





[31:28] | - Reserved, RESO. 





[27:24] | AuxRegs | Indicates support for Auxiliary registers. This value is: 


0x0 None supported. 





[23:4] |- Reserved, RESO. 





[3:0] | PC Sample | Indicates the level of Sample-based profiling support using external debug registers 40 through 43. This value is: 
0x3 EDPCSR, EDCIDSR and EDVIDSR are implemented. 

















The EDDEVID register can be accessed through the external debug interface, offset @xFC8. 


10.8.3 External Debug Device ID Register 1 
The EDDEVIDI register characteristics are: 





Purpose Provides extra information for external debuggers about features of the debug 
implementation. 
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Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























: x - = - RO 
Configurations The EDDEVID! register is in the Debug power domain. 
Attributes EDDEVID1 is a 32-bit register. 
The following figure shows the EDDEVID1 bit assignments. 
31 4 3 0 


Figure 10-9 EDDEVID1 bit assignments 
The following table shows the EDDEVID1 bit assignments. 


Table 10-13 EDDEVID1 bit assignments 





Bits |Name Function 





[31:4] | - Reserved, RESO. 





[3:0] | PCSROffset | Indicates the offset applied to PC samples returned by reads of EDPCSR. This value is: 


0x2 EDPCSR is implemented, and samples have no offset applied and do not sample the instruction set 
state in AArch32 state. 

















The EDDEVID! register can be accessed through the external debug interface, offset @xFC4. 


10.8.4 External Debug Peripheral Identification Registers 


The External Debug Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM® Debug Interface Architecture Specification, ADIv5.0 to ADIVS.2. 
They are a set of eight registers, listed in register number order in the following table. 


Table 10-14 Summary of the External Debug Peripheral Identification Registers 





Register | Value | Offset 





EDPIDR4 | 0x04 | @xFD@ 





EDPIDRS | 0x00 | @xFD4 





EDPIDR6 | 0x00 | @xFD8 





EDPIDR7 | 0x00 | @xFDC 





EDPIDRO | 0x09 | @xFE@ 





EDPIDRI | @xBD | @xFE4 





EDPIDR2 | @x@B _ | @xFE8 





EDPIDR3 | 0x00 | @xFEC 

















Only bits[7:0] of each External Debug Peripheral ID Register are used, with bits[3 1:8] reserved. 
Together, the eight External Debug Peripheral ID Registers define a single 64-bit Peripheral ID. 


The External Debug Peripheral ID registers are: 
¢ External Debug Peripheral Identification Register 0 on page 10-404. 
¢ External Debug Peripheral Identification Register I on page 10-404. 
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¢ External Debug Peripheral Identification Register 2 on page 10-405. 

¢ External Debug Peripheral Identification Register 3 on page 10-405. 

¢ External Debug Peripheral Identification Register 4 on page 10-406. 

¢ External Debug Peripheral Identification Register 5-7 on page 10-407. 

External Debug Peripheral Identification Register 0 

The EDPIDRO characteristics are: 

Purpose Provides information to identify an external debug component. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























a ome z - [RO 
Configurations The EDPIDRO is in the Debug power domain. 
Attributes EDPIDRO is a 32-bit register. 
The following figure shows the EDPIDRO bit assignments. 
31 8:7 0 


Figure 10-10 EDPIDRO bit assignments 
The following table shows the EDPIDRO bit assignments. 


Table 10-15 EDPIDRO bit assignments 





Bits 


Name 


Function 





[31:8] 


Reserved, RESO. 





[7:0] 





Part_0 


0x09 Least significant byte of the debug part number. 











The EDPIDRO can be accessed through the external debug interface, offset @xFE@. 


External Debug Peripheral Identification Register 1 
The EDPIDR1 characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





s e e e e TRO 


























Configurations The EDPIDRI! is in the Debug power domain. 
Attributes EDPIDR1 is a 32-bit register. 


The following figure shows the EDPIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 10-11 EDPIDR1 bit assignments 
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The following table shows the EDPIDR1 bit assignments. 


Table 10-16 EDPIDR1 bit assignments 




























































































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | DES 0] exp ARM Limited. This is the least significant nibble of JEP106 ID code. 
[3:0] | Part_! | exp Most significant nibble of the debug part number. 
The EDPIDRI can be accessed through the external debug interface, offset @xFE4. 
External Debug Peripheral Identification Register 2 
The EDPIDR2 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
sole h 7 - [RO 
Configurations The EDPIDR2 is in the Debug power domain. 
Attributes EDPIDR2 is a 32-bit register. 
The following figure shows the EDPIDR2 bit assignments. 
31 8 7 4 3 2 0 
| reson | | es 
JEDEC — 
Figure 10-12 EDPIDR2 bit assignments 
The following table shows the EDPIDR2 bit assignments. 
Table 10-17 EDPIDR2 bit assignments 
Bits |Name_ | Function 
[31:8] | - Reserved, RESO. 
[7:4] | Revision | 9x@ r0p0. 
[3] |JEDEC | pes Indicates a JEP106 identity code is used. 
[2:0] | DES_1 |@pe11 ARM Limited. These are the most significant bits of JEP106 ID code. 
The EDPIDR2 can be accessed through the external debug interface, offset @xFE8. 
External Debug Peripheral Identification Register 3 
The EDPIDR3 characteristics are: 
Purpose Provides information to identify an external debug component. 
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Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
ane e : - {RO 
Configurations The EDPIDR3 is in the Debug power domain. 
Attributes EDPIDR3 is a 32-bit register. 
The following figure shows the EDPIDR3 bit assignments. 
31 8 7 4 3 0 


Figure 10-13 EDPIDR3 bit assignments 
The following table shows the EDPIDR3 bit assignments. 


Table 10-18 EDPIDR3 bit assignments 
























































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | REVAND | 9x9 Part minor revision. 
[3:0] | CMOD 0x0 Customer modified. Indicates someone other than ARM Limited has modified the component. 
The EDPIDR3 can be accessed through the external debug interface, offset @xFEC. 
External Debug Peripheral Identification Register 4 
The EDPIDR4 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
s- le 2 : - [RO 
Configurations The EDPIDR4 is in the Debug power domain. 
Attributes EDPIDR4 is a 32-bit register. 
The following figure shows the EDPIDR4 bit assignments. 
31 8 7 4 3 0 
Figure 10-14 EDPIDR4 bit assignments 
The following table shows the EDPIDR4 bit assignments. 
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Table 10-19 EDPIDR4 bit assignments 

























































































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | Size Ox@ Size of the component. Log, the number of 4KB pages from the start of the component to the end of the 
component ID registers. 
[3:0] | DES 2} @x4 ARM Limited. This is the least significant nibble of the JEP 106 continuation code. 
The EDPIDR4 can be accessed through the external debug interface, offset @xFD@. 
External Debug Peripheral Identification Register 5-7 
No information is held in EDPIDR5, EDPIDR6, and EDPIDR7. They are reserved for future use and are 
RESO. 
10.8.5 External Debug Component Identification Registers 
There are four read-only External Debug Component Identification Registers. The following table shows 
these registers. 
Table 10-20 Summary of the External Debug Component Identification Registers 
Register | Value | Offset 
EDCIDRO | @x@D | OxFF@ 
EDCIDRI1 | 0x90 | OxFF4 
EDCIDR2 | 0x05 | OxFF8 
EDCIDR3 | @xB1 | OxFFC 
The External Debug Component Identification Registers identify Debug as an ARM” Debug Interface 
Architecture Specification, ADIv5.0 to ADIv5.2 component. The External Debug Component ID registers 
are: 
¢ External Debug Component Identification Register 0 on page 10-407. 
¢ External Debug Component Identification Register 1 on page 10-408. 
¢ External Debug Component Identification Register 2 on page 10-408. 
¢ External Debug Component Identification Register 3 on page 10-409. 
External Debug Component Identification Register 0 
The EDCIDRO characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
- - - - - RO 
Configurations The EDCIDRO is in the Debug power domain. 
Attributes EDCIDR0 is a 32-bit register. 
The following figure shows the EDCIDRO bit assignments. 
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31 8 7 0 


Figure 10-15 EDCIDRO bit assignments 
The following table shows the EDCIDR0O bit assignments. 


Table 10-21 EDCIDRO bit assignments 



















































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL_0| @xep Preamble byte 0. 
The EDCIDRO can be accessed through the external debug interface, offset @xFF@. 
External Debug Component Identification Register 1 
The EDCIDR1 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
- = s = - RO 
Configurations The EDCIDR1 is in the Debug power domain. 
Attributes EDCIDR1 is a 32-bit register. 
The following figure shows the EDCIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 10-16 EDCIDR1 bit assignments 
The following table shows the EDCIDRI bit assignments. 
Table 10-22 EDCIDR1 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | CLASS 0x9 Debug component. 
[3:0] | PRMBL_1 | @x@ Preamble byte 1. 
The EDCIDR! can be accessed through the external debug interface, offset @xFF4. 
External Debug Component Identification Register 2 
The EDCIDR2 characteristics are: 
Purpose Provides information to identify an external debug component. 
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Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
mane e : - {RO 
Configurations The EDCIDR2 is in the Debug power domain. 
Attributes EDCIDR2 is a 32-bit register. 
The following figure shows the EDCIDR2 bit assignments. 
31 8 7 0 


Figure 10-17 EDCIDR2 bit assignments 
The following table shows the EDCIDR2 bit assignments. 


Table 10-23 EDCIDR2 bit assignments 













































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 2) 9x@5 Preamble byte 2. 
The EDCIDR2 can be accessed through the external debug interface, offset @xFF8. 
External Debug Component Identification Register 3 
The EDCIDR3 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
2 7 = - - RO 
Configurations The EDCIDR3 is in the Debug power domain. 
Attributes EDCIDR3 is a 32-bit register. 
The following figure shows the EDCIDR3 bit assignments. 
31 8:7 0 
Figure 10-18 EDCIDR3 bit assignments 
The following table shows the EDCIDR3 bit assignments. 
Table 10-24 EDCIDR3 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 3) 9xB1 Preamble byte 3. 
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The EDCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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10.9 Debug events 
A debug event can be either: 


e A software debug event. 
e A halting debug event. 


A core responds to a debug event in one of the following ways: 
e Ignores the debug event. 

¢ Takes a debug exception. 

e Enters Debug state. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information on debug events. 


This section contains the following subsections: 


¢ 10.9.1 Watchpoint debug events on page 10-411. 
e 10.9.2 Debug OS Lock on page 10-411. 


10.9.1 Watchpoint debug events 


In the Cortex-A73 processor, watchpoint debug events are always synchronous. Memory hint 
instructions and cache clean operations, except DC ZVA, DC IVAC, and DC IMVAC, do not generate 
watchpoint debug events. Store exclusive instructions generate a watchpoint debug event even when the 
check for the control of exclusive monitor fails. 


For watchpoint debug events, except those resulting from cache maintenance operations, the value 
reported in DFAR is guaranteed to be no lower than the address of the watchpointed location rounded 
down to a multiple of 16 bytes. 


10.9.2 Debug OS Lock 


Debug OS Lock is set by the powerup reset, hCPUPORESET[CN:0]. For normal behavior of debug 
events and debug register accesses, Debug OS Lock must be cleared. 


See 2.3.3 Resets on page 2-37 and the ARM” Architecture Reference Manual ARMVv8, for ARMv8-A 
architecture profile for more information. 
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10 Debug 


10.10 External debug interface 


The system can access memory-mapped debug registers through the APB interface. The APB interface is 
compliant with the AMBA 3 APB v1.0 interface. 


The following figure shows the debug interface implemented in the Cortex-A73 processor. For more 
information on these signals, see the ARM® CoreSight Architecture Specification. 


Authentication 
interface 


DCC 
handshake 


Debug state 
entry 


Power 
controller 
interface 


Reset 
controller 
interface 
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Processor 


This section contains the following subsections: 


e 10.10.1 Debug memory map on page 10-412. 


e 10.10.2 DBGPWRDUP debug signal on page 10-413. 
e 10.10.3 DBGLIRSTDISABLE debug signal on page 10-413. 
e 10.10.4 Changing the authentication signals on page 10-414. 


10.10.1 


The basic memory map supports up to four cores in the cluster. 


Debug memory map 


}¢—_PCLKENDBG———_ ~ 
i¢——PSELDBG 
}¢—PADDRDBG31— 
¢——PADDRDBG—— 
—PRDATADBG —»> 
¢—PWDATADBG —— 
}¢—_PENABLEDBG—— 
PREADYDBG—> 
PSLVERRBG—> 
}¢——_PWRITEDBG———__ 





¢—DBGROMADDR— 
}¢-DBGROMADDRV—. 








Debug slave 
port 
AMBA 3 APB 
v1.0 


Configuration 


Figure 10-19 External debug interface 


The following table shows the address mapping for the Cortex-A73 processor debug APB components. 
Each component in the table requires 4KB, and uses the bottom 4KB of each 64KB region. The 


remaining 60KB of each region is reserved. 





de 


Indicates the mapped component if present, otherwise reserved. 


Table 10-25 Address mapping for APB components 





Address offset [21:0] 


Component“ 





0x000000 - OxOGOFFF 


Cortex-A73 APB ROM table 





0x010000 - OxO10FFF 


Core 0 Debug 








0x020000 - OxO20FFF 





Core 0 CTI 











ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


10-412 


10.10.2 


DBGPWRDUP debug signal 
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Table 10-25 Address mapping for APB components (continued) 





Address offset [21:0] 


Component: 





0x030000 - 0x030FFF 


Core 0 PMU 





0x040000 - 0x040FFF 


Core 0 Trace 





0x041000 - @x1OFFFF 


Reserved 





0x110000 - @x110FFF 


Core 1 Debug 





0x120000 - @x120FFF 


Core 1 CTI 





0x130000 - @x130FFF 


Core 1 PMU 





0x140000 - @x140FFF 


Core | Trace 





0x141000 - Ox2OFFFF 


Reserved 





0x210000 - @x210FFF 


Core 2 Debug 





0x220000 - Ox220FFF 


Core 2 CTI 





0x230000 - @x230FFF 


Core 2 PMU 





0x240000 - Ox240FFF 


Core 2 Trace 





0x241000 - Ox3OFFFF 


Reserved 





0x310000 - @x310FFF 


Core 3 Debug 





0x320000 - @x320FFF 


Core 3 CTI 





0x330000 - Ox330FFF 


Core 3 PMU 





0x340000 - Ox340FFF 


Core 3 Trace 








0x341000 - Ox3FFFFF 





Reserved 








You must set the DBGPWRDUP[n] signal LOW before removing power to the core domain. After 
power is restored to the core domain, the DBGPWRDUP{n] signal must be asserted HIGH. The 
EDPRSR.PU bit reflects the value of this DBGPWRDUP{[n] signal. 


Note 


DBGPWRDUP[n] must be tied HIGH if the particular implementation does not support separate core 
and SCU power domains. 








10.10.3 DBGL1IRSTDISABLE debug signal 


When set HIGH, the DBGLIRSTDISABLE input signal disables the automatic hardware controlled 
invalidation of the L1 data cache after the processor is reset, using nCORERESET or 
nCPUPORESET. 


The DBGLIRSTDISABLE must be used only to assist debug of an external watchdog triggered reset 
by allowing the contents of the L1 data cache prior to the reset to be observable after the reset. If reset is 
asserted, while an L1 data cache eviction or L1 data cache fetch is performed, the accuracy of those 
cache entries is not guaranteed. 


You must not use the DBGLIRSTDISABLE signal to disable automatic hardware controlled 
invalidation of the L1 data cache in normal processor powerup sequences. This is because 





de Indicates the mapped component if present, otherwise reserved. 
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synchronization of the L1 data cache invalidation sequence with the duplicate L1 tags in the SCU is not 
guaranteed. 


The DBGLIRSTDISABLE signal applies to all cores in the cluster. Each core samples the signal when 
nCORERESET or nCPUPORESET is asserted. 


If the functionality offered by the DBGLIRSTDISABLE input signal is not required, the input must be 
tied to LOW. 


10.10.4 Changing the authentication signals 


The NIDEN[n], DBGEN[n], SPIDEN[n], and SPNIDEN[n] input signals are either tied off to some 
fixed value or controlled by some external device. 


If software running on the processor has control over an external device that drives the authentication 

signals, it must make the change using a safe sequence: 

1. Execute an implementation-specific sequence of instructions to change the signal value. For example, 
this might be a single STR instruction that writes certain values to a control register in a system 
peripheral. 

2. Ifthe previous step involves any memory operation, issue a DSB instruction. 

3. Poll the DBGAUTHSTATUS EL] to check whether the processor has already detected the changed 
value of these signals. This is required because the system might not issue the signal change to the 
processor until several cycles after the DSB instruction completes. 

4. Issue an ISB instruction, an exception entry, or an exception return. 


The software cannot perform debug or analysis operations that depend on the new value of the 
authentication signals until this procedure is complete. The same rules apply when the debugger has 
control of the processor through the External Debug Instruction Transfer Register, EDITR, while in 
Debug state. The relevant combinations of the DBGEN[n], NIDEN[n], SPIDEN[n], and SPNIDEN[n] 
values can be determined by polling DBGAUTHSTATUS ELI. 
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10.11 ROM table 


Debuggers can use the ROM table to determine which components are implemented. 


The Cortex-A73 processor includes a ROM table that complies with the ARM” CoreSight Architecture 
Specification. This table contains a list of components such as debug units, Cross Trigger Interfaces 
(CTIs), Performance Monitoring Units (PMUs) and Embedded Trace Macrocell (ETM) units. 


If a component is not included in your configuration of the Cortex-A73 processor, the ROMENTRY 
registers for its debug, CTI, PMU and ETM trace unit components are 0x00000000. 


The interface to the ROM table entries is the APB slave port. See 70.10 External debug interface 
on page 10-412 for more information. 


This section contains the following subsections: 

e 10.11.1 ROM table register summary on page 10-415. 

e 10.11.2 ROM table register descriptions on page 10-416. 

e 10.11.3 ROM table Debug Peripheral Identification Registers on page 10-418. 

e 10.11.4 ROM tables Debug Component Identification Registers on page 10-421. 
10.11.1 ROM table register summary 


The following table shows the offsets from the physical base address of the ROM table. 


Table 10-26 ROM table registers 































































































Offset Name Type | Description 

0x000 ROMENTRYO |RO | Core 0 Debug, see ROM entry registers on page 10-416 

0x004 ROMENTRYI |RO | Core 0 CTI, see ROM entry registers on page 10-416 

0x008 ROMENTRY2 |RO | Core 0 PMU, see ROM entry registers on page 10-416 

@x@e@C ROMENTRY3 |RO | Core 0 ETM, see ROM entry registers on page 10-416 

0x010 ROMENTRY4 |RO |Core 1 Debug, see ROM entry registers on page 10-416 

0x014 ROMENTRY5 |RO | Core 1 CTI, see ROM entry registers on page 10-416 

0x018 ROMENTRY6 |RO | Core 1 PMU, see ROM entry registers on page 10-416 

@x@1C ROMENTRY7 |RO | Core 1 ETM, see ROM entry registers on page 10-416 

0x020 ROMENTRY8 |RO |Core 2 Debug, see ROM entry registers on page 10-416 

0x024 ROMENTRY9 |RO | Core 2 CTI, see ROM entry registers on page 10-416 

0x028 ROMENTRY10|RO | Core 2 PMU, see ROM entry registers on page 10-416 

0x02C ROMENTRY11 [RO | Core 2 ETM, see ROM entry registers on page 10-416 

0x030 ROMENTRY12|RO | Core 3 Debug, see ROM entry registers on page 10-416 

0x034 ROMENTRY13 |RO | Core 3 CTI, see ROM entry registers on page 10-416 

0x038 ROMENTRY14|RO | Core 3 PMU, see ROM entry registers on page 10-416 

@x@3C ROMENTRY15|RO_ | Core 3 ETM, see ROM entry registers on page 10-416 

@x@40-@xFCC | - RO _| Reserved, RESO 

@xFDO ROMPIDR4 RO | ROM table Debug Peripheral Identification Register 4 on page 10-421 

@xFD4 ROMPIDRS5 RO | ROM table Debug Peripheral Identification Register 5-7 on page 10-421 

@xFD8 ROMPIDR6 RO | ROM table Debug Peripheral Identification Register 5-7 on page 10-421 
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Table 10-26 ROM table registers (continued) 















































Offset Name Type | Description 

@xFDC ROMPIDR7 RO | ROM table Debug Peripheral Identification Register 5-7 on page 10-421 
OxFEO ROMPIDRO RO | ROM table Debug Peripheral Identification Register 0 on page 10-418 
OxFE4 ROMPIDR1 RO | ROM table Debug Peripheral Identification Register 1 on page 10-419 
OxFE8 ROMPIDR2 RO | ROM table Debug Peripheral Identification Register 2 on page 10-419 
@xFEC ROMPIDR3 RO | ROM table Debug Peripheral Identification Register 3 on page 10-420 
OxFFO ROMCIDRO RO | ROM table Debug Component Identification Register 0 on page 10-422 
OxFF4 ROMCIDR1 RO | ROM table Debug Component Identification Register 1 on page 10-422 
OxFF8 ROMCIDR2 RO | ROM table Debug Component Identification Register 2 on page 10-423 
@xFFC ROMCIDR3 RO | ROM table Debug Component Identification Register 3 on page 10-423 








10.11.2 ROM table register descriptions 
This section describes the ROM table registers. 


10.11.1 ROM table register summary on page 10-415 provides cross-references to individual registers. 


ROM entry registers 
The characteristics of the ROMENTRY7 registers are: 


Purpose Indicates to a debugger whether the debug component is present in the core debug 
logic. There are 16 ROMENTRY registers in the Cortex-A73 processor. 


Usage constraints These registers are accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 


























el ne) e RO 





Configurations There is one copy of these registers that is used in both Secure and Non-secure 
states. 


Attributes ROMENTRY»n are 32-bit registers. 


The following figure shows the bit assignments fora ROMENTRY register. 


31 12 11 2 1 0 


sot o L 
Format —! 
Component present 
Figure 10-20 ROMENTRY bit assignments 
The following table shows the bit assignments fora ROMENTRY register. 
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Table 10-27 ROMENTRY bit assignments 

















2) 
1 


End marker. 


32-bit format. 


Bits |Name Function 
[31:12] | Address offset Address offset for the debug component. 
Note 
Negative values of address offsets are permitted using the two’s complement of the offset. 
[11:2] |- Reserved, RESO. 
[1] Format Format of the ROM table entry. The value for all ROMENTRY registers is: 





[0] 








Component present“? 





Indicates whether the component is present: 


(2) 
1 


Component is not present. 


Component is present. 








The Physical Address of a debug component is determined by shifting the address offset 12 places to the 
left and adding the result to the Physical Address of the Cortex-A73 processor ROM table. 


If a core is not implemented, the ROMENTRY registers for its debug, CTI, PMU and ETM trace unit 
components are @x@8000000 when a v8 memory map is implemented. 





df 


Table 10-28 v8 ROMENTRY values 







































































Name Debug component | Address offset[31:12] | ROMENTRY value 
ROMENTRY0 | Core 0 Debug 0x00010 0x000190003 
ROMENTRY1 | Core 0 CTI 0x00020 0x00020003 
ROMENTRY2 | Core 0 PMU 0x00030 0x00030003 
ROMENTRY3 | Core 0 ETM trace unit | 0x00040 0x00040003 
ROMENTRY4 | Core 1 Debug 0x00110 0x0011000348 
ROMENTRY5 | Core 1 CTI 0x00120 0x0012000348 
ROMENTRY6 | Core 1 PMU 0x00130 @xee130003"2 
ROMENTRY7 | Core 1 ETM trace unit | 0x00140 0x0014000348 
ROMENTRY8 | Core 2 Debug 0x00210 Qx00210003°5 
ROMENTRY9Y | Core 2 CTI 0x00220 0x00220003°8 
ROMENTRY 10 | Core 2 PMU 0x00230 0x0023000348 
ROMENTRY 11 | Core 2 ETM trace unit | 0x00240 0x00240003°8 
ROMENTRY 12 | Core 3 Debug 0x00310 0x00310003°8 
ROMENTRY 13 | Core 3 CTI 0x00320 0x0032000348 
ROMENTRY 14 | Core 3 PMU 0x00330 0x0033000348 
ROMENTRY 15 | Core 3 ETM trace unit | 0x00340 0xee340003"2 











The components for Core 0 are always present. The entries for Core 1, 2, and 3 components depend on your configuration. 
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10 Debug 
10.11 ROM table 


10.11.3 ROM table Debug Peripheral Identification Registers 


The ROM table Debug Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM® Debug Interface Architecture Specification, ADIv5.0 to ADIVS.2. 
There is a set of eight registers, listed in register number order in the following table. 


Table 10-29 Summary of the ROM table Debug Peripheral Identification Registers 





Register | Value | Offset 





ROMPIDR4 | 0x04 | @xFD@ 





ROMPIDRS | 0x00 | @xFD4 





ROMPIDR6 | 0x00 | @xFD8 





ROMPIDR7 | 0x00 | @xFDC 





ROMPIDRO | @xA6 | OxFE@ 





ROMPIDRI | 0xB4 | @xFE4 





ROMPIDR2 | @x®B_ | OxFE8 








ROMPIDR3 | 0x00 | @xFEC 














Only bits[7:0] of each ROM table Debug Peripheral ID Register are used, with bits[3 1:8] reserved. 
Together, the eight ROM table Debug Peripheral ID Registers define a single 64-bit Peripheral ID. 
The ROM table Debug Peripheral ID registers are: 

e ROM table Debug Peripheral Identification Register 0 on page 10-418. 

e ROM table Debug Peripheral Identification Register 1 on page 10-419. 

e ROM table Debug Peripheral Identification Register 2 on page 10-419. 

e ROM table Debug Peripheral Identification Register 3 on page 10-420. 

e ROM table Debug Peripheral Identification Register 4 on page 10-421. 

e ROM table Debug Peripheral Identification Register 5-7 on page 10-421. 


ROM table Debug Peripheral Identification Register 0 
The ROMPIDRO characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























a ie > r - {RO 
Configurations The ROMPIDR0O is in the Debug power domain. 
Attributes ROMPIDRO is a 32-bit register. 
The following figure shows the ROMPIDRO bit assignments. 
31 8 7 0 


Figure 10-21 ROMPIDRO bit assignments 
The following table shows the ROMPIDRO bit assignments. 





dg If the component is present. 
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Table 10-30 ROMPIDRO bit assignments 




















































































































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:0] | Part_0 | exa6 Least significant byte of the ROM table part number. 
The ROMPIDRO can be accessed through the external debug interface, offset @xFE@. 
ROM table Debug Peripheral Identification Register 1 
The ROMPIDRI characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
z Ne : : - {RO 
Configurations The ROMPIDR1 is in the Debug power domain. 
Attributes ROMPIDR1 is a 32-bit register. 
The following figure shows the ROMPIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 10-22 ROMPIDR1 bit assignments 
The following table shows the ROMPIDR1 bit assignments. 
Table 10-31 ROMPIDR1 bit assignments 
Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | DES_0| øxB ARM Limited. Least significant nibble of JEP106 ID code. 
[3:0] | Part_! | @x4 Most significant nibble of the ROM table part number. 
The ROMPIDRI can be accessed through the external debug interface, offset @xFE4. 
ROM table Debug Peripheral Identification Register 2 
The ROMPIDR2 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
z |S : E - [RO 
Configurations The ROMPIDR2 is in the Debug power domain. 
Attributes ROMPIDR2 is a 32-bit register. 
The following figure shows the ROMPIDR2 bit assignments. 
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31 8 7 432 0 
JEDEC — 


Figure 10-23 ROMPIDR2 bit assignments 
The following table shows the ROMPIDR2 bit assignments. 


Table 10-32 ROMPIDR2 bit assignments 






















































































Bits |Name_ | Function 
[31:8] | - Reserved, RESO. 
[7:4] | Revision | 9x@ r0p0. 
[B] |JEDEC | @b1 Indicates a JEP106 identity code is used. 
[2:0] |DES_1 | @be11 ARM Limited. Most significant bits of JEP106 ID code. 
The ROMPIDR2 can be accessed through the external debug interface, offset @xFE8. 
ROM table Debug Peripheral Identification Register 3 
The ROMPIDR3 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
3 e a : - {RO 
Configurations The ROMPIDR3 is in the Debug power domain. 
Attributes ROMPIDR3 is a 32-bit register. 
The following figure shows the ROMPIDR3 bit assignments. 
31 8 7 4 3 0 
Figure 10-24 ROMPIDR3 bit assignments 
The following table shows the ROMPIDR3 bit assignments. 
Table 10-33 ROMPIDR3 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | REVAND | exe Part minor revision. 
[3:0] |CMOD | exe Customer modified. 
The ROMPIDR3 can be accessed through the external debug interface, offset @xFEC. 
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ROM table Debug Peripheral Identification Register 4 
The ROMPIDR4 characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























-g B 2 - | RO 
Configurations The ROMPIDR4 is in the Debug power domain. 
Attributes ROMPIDR4 is a 32-bit register. 
The following figure shows the ROMPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 10-25 ROMPIDR4 bit assignments 
The following table shows the ROMPIDR4 bit assignments. 


Table 10-34 ROMPIDR4 bit assignments 





Bits 


Name 


Function 





[31:8] 


Reserved, RESO. 





[7:4] 


Size 


Ox@ Size of the component. Log, the number of 4KB pages from the start of the component to the end of the 
component ID registers. 





[3:0] 





DES 2 





0x4 ARM Limited. Least significant nibble of the JEP106 continuation code. 








10.11.4 


The ROMPIDR4 can be accessed through the external debug interface, offset @xFD@. 


ROM table Debug Peripheral Identification Register 5-7 


No information is held in ROMPIDRS5, ROMPIDR6, and ROMPIDR7. They are reserved for future use 
and are RESO. 


ROM tables Debug Component Identification Registers 


There are four read-only ROM table Debug Component Identification Registers. The following table 
shows these registers. 


Table 10-35 Summary of the ROM table Debug Component Identification registers 





Register | Value | Offset 





ROMCIDRO | @x@D | @xFF@ 





ROMCIDRI | 0x10 | OxFF4 





ROMCIDR2 | 0x05 | OxFF8& 





ROMCIDR3 | @xB1 | OxFFC 

















The ROM table Debug Component Identification Registers identify Debug as an ARM” Debug Interface 
Architecture Specification, ADIv5.0 to ADIv5.2 component. 
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ROM table Debug Component Identification Register 0 
The ROMCIDRO characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints This register is accessible as follows: 





Off | DLK | OSLK | EDAD | SLK | Default 





























= |e : 2 - | RO 
Configurations The ROMCIDRO is in the Debug power domain. 
Attributes ROMCIDRO is a 32-bit register. 
The following figure shows the ROMCIDRO bit assignments. 
31 8 7 0 


Figure 10-26 ROMCIDRO bit assignments 
The following table shows the ROMCIDRO bit assignments. 


Table 10-36 ROMCIDRO bit assignments 
























































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] |PRMBL_0)@xe@p Preamble byte 0. 
The ROMCIDRO can be accessed through the external debug interface, offset @xFF®. 
ROM table Debug Component Identification Register 1 
The ROMCIDRI characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
z a = ; - {RO 
Configurations The ROMCIDR1 is in the Debug power domain. 
Attributes ROMCIDR! is a 32-bit register. 
The following figure shows the ROMCIDRI bit assignments. 
31 8 7 4 3 0 
Figure 10-27 ROMCIDR1 bit assignments 
The following table shows the ROMCIDR1 bit assignments. 
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Table 10-37 ROMCIDR1 bit assignments 




















































































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | CLASS @x1 Component Class. For a ROM table. 
[3:0] | PRMBL_1] exe Preamble byte 1. 
The ROMCIDRI can be accessed through the external debug interface, offset @xFF4. 
ROM table Debug Component Identification Register 2 
The ROMCIDR2 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
a. illa Z : - {RO 
Configurations The ROMCIDR2 is in the Debug power domain. 
Attributes ROMCIDR2 is a 32-bit register. 
The following figure shows the ROMCIDR2 bit assignments. 
31 8 7 0 
Figure 10-28 ROMCIDR2 bit assignments 
The following table shows the ROMCIDR2 bit assignments. 
Table 10-38 ROMCIDR2 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 2 | @x@5 Preamble byte 2. 
The ROMCIDR2 can be accessed through the external debug interface, offset @xFF8. 
ROM table Debug Component Identification Register 3 
The ROMCIDR3 characteristics are: 
Purpose Provides information to identify an external debug component. 
Usage constraints This register is accessible as follows: 
Off | DLK | OSLK | EDAD | SLK | Default 
ie : E - [RO 
Configurations The ROMCIDR3 is in the Debug power domain. 
Attributes ROMCIDR3 is a 32-bit register. 
The following figure shows the ROMCIDR3 bit assignments. 
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31 8 7 0 


Figure 10-29 ROMCIDR3 bit assignments 


The following table shows the ROMCIDR3 bit assignments. 
Table 10-39 ROMCIDR3 bit assignments 


Bits |Name Function 





[31:8] | - Reserved, RESO. 








[7:0] | PRMBL 3 | @xB1 Preamble byte 3. 











The ROMCIDR3 can be accessed through the external debug interface, offset @xFFC. 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 10-424 


reserved. 
Non-Confidential 


Chapter 11 
Performance Monitor Unit 


This chapter describes the Performance Monitor Unit (PMU) and the registers that it uses. 


It contains the following sections: 

¢ 11.1 About the PMU on page 11-426. 

e 11.2 PMU functional description on page 11-427. 

e 11.3 AArch64 PMU register summary on page 11-429. 

e 11.4 AArch64 PMU register descriptions on page 11-431. 

e 11.5 AArch32 PMU register summary on page 11-438. 

e 11.6 AArch32 PMU register descriptions on page 11-440. 

¢ 11.7 Memory-mapped PMU register summary on page 11-447. 
¢ 11.8 Memory-mapped PMU register descriptions on page 11-449. 
e 11.9 Events on page 11-457. 

e 11.10 Interrupts on page 11-461. 

e 11.11 Exporting PMU events on page 11-462. 
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11.1 About the PMU 


11.1 About the PMU 


The Cortex-A73 processor includes performance monitors that implement the ARM PMUv3 
architecture. These enable you to gather various statistics on the operation of the core and its memory 
system during runtime. These provide useful information about the behavior of the core that you can use 
when debugging or profiling code. 


The PMU provides six counters. Each counter can count any of the events available in the core. The 
absolute counts recorded might vary because of pipeline effects. This has negligible effect except in 
cases where the counters are enabled for a very short time. 
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11.2 PMU functional description 
The following figure shows the major blocks inside the PMU. 
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Figure 11-1 PMU block diagram 


Event Interface 
Events from all other units from across the design are provided to the PMU. 
System register and APB interface 
You can program the PMU registers using the system registers or external APB interface. 
Counters 
The PMU has 32-bit counters that increment when they are enabled based on events and a 64-bit 
cycle counter. 
PMU register interfaces 
The Cortex-A73 processor supports access to the performance monitor registers from the 
internal system register. External access to the performance monitor registers is also provided 
with the APB slave port or external debug interface. See 70.10 External debug interface 
on page 10-412. 


This section contains the following subsections: 

e 11.2.1 External register access permissions on page 11-427. 
11.2.1 External register access permissions 

Whether or not access is permitted to a register depends on: 


e Ifthe processor is powered up. 
¢ The state of the OS Lock, OS Double Lock, and Software Lock. 
e The state of the debug authentication inputs to the processor. 
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11.2 PMU functional description 


The behavior is specific to each register and is not described in this document. For a detailed description 
of these features and their effects on the registers, see the ARM" Architecture Reference Manual ARMVv8, 
for ARMv8-A architecture profile. 


The register descriptions provided in this section does describe whether each register is read/write or 
read-only. 
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11.3 AArch64 PMU register summary 


The PMU counters and their associated control registers are accessible in the AArch64 execution state 


with MRS and MSR instructions. 


11 Performance Monitor Unit 
11.3 AArch64 PMU register summary 


The following table gives a summary of the Cortex-A73 PMU registers in the AArch64 execution state. 
For those registers not described in this chapter, see the ARM® Architecture Reference Manual ARMVvé8, 


for ARMv8-A architecture profile. 


Table 11-1 PMU register summary in AArch64 state 




























































































Name Type Width Description 

PMCR_ELO RW 32-bit 11.4.1 Performance Monitors Control 
Register on page 11-431 

PMCNTENSET ELO RW 32-bit Performance Monitors Count Enable 
Set Register 

PMCNTENCLR_ELO RW 32-bit Performance Monitors Count Enable 
Clear Register 

PMOVSCLR_ELO RW 32-bit Performance Monitors Overflow Flag 
Status Register 

PMSWINC ELO WO 32-bit Performance Monitors Software 
Increment Register 

PMSELR_ELO RW 32-bit Performance Monitors Event Counter 
Selection Register 

PMCEIDO_ELO RO 32-bit 11.4.2 Performance Monitors Common 
Event Identification Register 0 
on page 11-433 

PMCEID1_ ELO RO 32-bit 11.4.3 Performance Monitors Common 
Event Identification Register 1 
on page 11-436 

PMCCNTR_ELO RW 64-bit Performance Monitors Cycle Count 
Register 

PMXEVTYPER_ELO RW 32-bit Performance Monitors Selected Event 
Type and Filter Register 

PMCCFILTR_ELO RW 32-bit Performance Monitors Cycle Count 
Filter Register 

PMXEVCNTRO_ELO RW 32-bit Performance Monitors Selected Event 
Count Register 

PMUSERENR_ ELO RW 32-bit Performance Monitors User Enable 
Register 

PMINTENSET EL1 RW 32-bit Performance Monitors Interrupt Enable 
Set Register 

PMINTENCLR EL1 RW 32-bit Performance Monitors Interrupt Enable 
Clear Register 

PMOVSSET_ELO RW 32-bit Performance Monitors Overflow Flag 
Status Set Register 

ARM 100048 _0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 11-429 
reserved. 


Non-Confidential 


11 Performance Monitor Unit 
11.3 AArch64 PMU register summary 


Table 11-1 PMU register summary in AArch64 state (continued) 







































































Name Type Width Description 
PMEVCNTRO_ ELO RW 32-bit Performance Monitors Event Count 
PMEVCNTRI1_ELO RW 32-bit Reeser 
PMEVCNTR2_ELO RW 32-bit 
PMEVCNTR3_ELO RW 32-bit 
PMEVCNTR4 ELO RW 32-bit 
PMEVCNTRS_ELO RW 32-bit 
PMEVTYPERO ELO RW 32-bit Performance Monitors Event Type 
PMEVTYPERIL ELO RW 32-bit Regier 
PMXVTYPER2_ ELO RW 32-bit 
PMEVTYPER3_ELO RW 32-bit 
PMEVTYPER4 ELO RW 32-bit 
PMEVTYPERS_ELO RW 32-bit 
PMCCFILTR_ELO RW 32-bit Performance Monitors Cycle Count 
Filter Register 
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11.4 AArch64 PMU register descriptions 

































































11.4 AArch64 PMU register descriptions 
This section describes the Cortex-A73 processor PMU registers in AArch64 state. 
11.3 AArch64 PMU register summary on page 11-429 provides cross-references to individual registers. 
This section contains the following subsections: 
e 11.4.1 Performance Monitors Control Register on page 11-431. 
e 11.4.2 Performance Monitors Common Event Identification Register 0 on page 11-433. 
e 11.4.3 Performance Monitors Common Event Identification Register 1 on page 11-436. 
11.4.1 Performance Monitors Control Register 
The PMCR_ELO characteristics are: 
Purpose Provides details of the Performance Monitors implementation, including the number 
of counters implemented, and configures and controls the counters. 
Usage constraints This register is accessible as follows: 
ELO | EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
RW |RW |RW | RW | RW RW 
This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 
Configurations © PMCR_ELO is architecturally mapped to the AArch32 register PMCR. See 
11.6.1 Performance Monitors Control Register on page 11-440. 
Attributes PMCR ELO is a 32-bit register. 
The following figure shows the PMCR_ELO bit assignments. 
24 23 16 15 11 10 76543210 
Pe ee | E 
Figure 11-2 PMCR_ELO bit assignments 
The following table shows the PMCR_ELO bit assignments. 
Table 11-2 PMCR_ELO bit assignments 
Bits |Name_ | Function 
[31:24] | IMP Implementer code. This value is: 
0x41 ARM Limited. 
This is a read-only field. 
[23:16] | IDCODE | Identification code. This value is: 
0x04 Cortex-A73 processor. 
This is a read-only field. 
[15:11] |N Number of event counters. This value is: 
0x6 Six counters are implemented. 
[10:7] |- Reserved, RESO. 
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Table 11-2 PMCR_ELO bit assignments (continued) 





Bits Name Function 





[6] LC Long cycle count enable. Determines which PMCCNTR_ELO bit generates an overflow recorded in 
PMOVSR[31]. The possible values are: 


© Overflow on increment that changes PMCCNTR_ELO[31] from 1 to @. 
1 Overflow on increment that changes PMCCNTR_ELO0[63] from 1 to @. 


This bit resets to 0. 





[5] DP Disable cycle counter when event counting is prohibited. The possible values of this bit are: 


@ PMCCNTR_ELO, if enabled, counts when event counting is prohibited. 
1 PMCCNTR_ELO does not count when event counting is prohibited. 


This bit is read/write and resets to 0. 





[4] X Export enable. This bit permits events to be exported to another debug device, such as a trace macrocell, over an 
event bus. The possible values of this bit are: 


(2 Do not export events. 


1 Export events where not prohibited. 


This bit is read/write and does not affect the generation of Performance Monitors interrupts on the nPMUIRQ 
pin. 


This bit resets to 0. 





[3] D Clock divider. The possible values of this bit are: 


@ When enabled, PMCCNTR_ELO counts every clock cycle. 
1 When enabled, PMCCNTR_ELO counts every 64 clock cycles. 


This bit is read/write and resets to 0. 





[2] C Clock counter reset. This bit is WO. The effects of writing to this bit are: 
(2) No action. 
1 Reset PMCCNTR_ELO to 9. 


This bit is always RESO and resets to 0. 
Note 


Resetting PMCCNTR does not clear the PMCCNTR_ELO overflow bit to @. See the ARM® Architecture Reference 
Manual ARMVv8, for ARMv8-A architecture profile for more information. 
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11.4 AArch64 PMU register descriptions 


Table 11-2 PMCR_ELO bit assignments (continued) 





Bits Name Function 





[1] P Event counter reset. This bit is WO. The effects of writing to this bit are: 
@ Noaction. 

1 Reset all event counters, not including PMCCNTR_ELO, to @. 
This bit is always RESO. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that MDCR_EL2.HPMN 
reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 
Resetting the event counters does not clear any overflow bits to @. 


This bit resets to 0. 





[0] E Enable. The possible values of this bit are: 

@ All counters, including PMCCNTR_ELOỌ, are disabled. 
1 All counters are enabled by PMCNTENSET ELO. 
This bit is RW. 


In Non-secure ELO and EL1, this bit does not affect the operation of event counters that MDCR_EL2.HPMN 
reserves for EL2 use. 


This bit resets to 0. 

















To access the PMCR_ELO: 


MRS <Xt>, PMCR_EL@ ; Read PMCR_EL® into Xt 
MSR PMCR_EL@, <Xt> ; Write Xt to PMCR_EL® 


To access the PMCR in AArch32 state, read or write the CP15 registers with: 


MRC p15, ©, <Rt>, c9, c12, @; Read Performance Monitor Control Register 
MCR p15, ©, <Rt>, c9, c12, @; Write Performance Monitor Control Register 


The PMCR_ELO can be accessed through the external debug interface, offset @xEe4. 


11.4.2 Performance Monitors Common Event Identification Register 0 
The PMCEIDO_ELO register characteristics are: 








Purpose Defines which common architectural and common microarchitectural feature events 
are implemented. 
Usage This register is accessible as follows: 
constraints 
ELO |EL1 |EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config |RO |RO |RO |RO RO 























This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations The PMCEIDO EL register is architecturally mapped to: 
e The AArch32 register PMCEIDO. See //.6.2 Performance Monitors Common 


Event Identification Register 0 on page 11-442. 
¢ The external register PMCEIDO ELO. 





Attributes PMCEID0_ELO is a 32-bit register. 
ARM 100048 _0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 11-433 
reserved. 


Non-Confidential 


11 Performance Monitor Unit 
11.4 AArch64 PMU register descriptions 


The following figure shows the PMCEIDO_ELO bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 10 9 8 76543210 


Figure 11-3 PMCEID0O_ELO bit assignments 
The following table shows the PMCEIDO_ELO bit assignments 


Table 11-3 PMCEIDO_ELO bit assignments 







































































Bits |Name_ | Function 
[31:0] | CE[31:0] | Common architectural and microarchitectural feature events that can be counted by the PMU event counters. 
For each bit described in the following table, the event is implemented if the bit is set to 1, or not implemented if 
the bit is set to ©. 
Table 11-4 PMU common events 
Bit | Event number | Event mnemonic Description 
[31] | @x1F L1ID_CACHE ALLOCATE L1 data cache allocate: 
2) This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 

[29] | @x1D BUS_ CYCLES Bus cycle: 

1 This event is implemented. 

[28] | @x1C TTBR_WRITE_ RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 

1 This event is implemented. 

[27] | @x1B INST_SPEC Instruction speculatively executed: 

1 This event is implemented. 

[26] | @x1A MEMORY ERROR Local memory error: 

(2 This event is not implemented. 

[25] | 0x19 BUS_ACCESS Bus access: 

1 This event is implemented. 

[24] | 0x18 L2D_CACHE_WB L2 data cache Write-Back: 

1 This event is implemented. 

[23] | 0x17 L2D_CACHE_REFILL L2 data cache refill: 

1 This event is implemented. 
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Table 11-4 PMU common events (continued) 






























































Bit | Event number | Event mnemonic Description 
[22] | 0x16 L2D_CACHE L2 data cache access: 
1 This event is implemented. 
[21] | 0x15 LID_CACHE_WB L1 data cache Write-Back: 
1 This event is implemented. 
[20] | 0x14 L1I CACHE L1 instruction cache access: 
1 This event is implemented. 
[19] | 0x13 MEM_ACCESS Data memory access: 
1 This event is implemented. 
[18] | 0x12 BR_PRED Predictable branch speculatively executed: 
1 This event is implemented. 
[17] | 0x11 CPU_CYCLES Cycle: 
1 This event is implemented. 
[16] | 0x10 BR_MIS_PRED Mispredicted or not predicted branch speculatively executed: 
1 This event is implemented. 
[15] | @xOF UNALIGNED_LDST_RETIRED | Instruction architecturally executed, condition check pass - unaligned load 
or store: 
2) This event is not implemented. 
[14] | @x@E BR_RETURN_RETIRED Instruction architecturally executed, condition check pass - procedure 
return: 
1 This event is implemented. 
[13] | @xeD BR_IMMED RETIRED Instruction architecturally executed - immediate branch: 
1 This event is implemented. 
[12] | exec PC_WRITE_ RETIRED Instruction architecturally executed, condition check pass - software 
change of the PC: 
1 This event is implemented. 
[11] | @xeB CID_WRITE_ RETIRED Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 
1 This event is implemented. 
[10] | @x@A EXC _ RETURN Instruction architecturally executed, condition check pass - exception 
return: 
1 This event is implemented. 
[9] | 0x09 EXC_TAKEN Exception taken: 


1 This event is implemented. 
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Table 11-4 PMU common events (continued) 






























































Bit | Event number | Event mnemonic Description 
[8] | 0x08 INST_RETIRED Instruction architecturally executed: 
1 This event is implemented. 
[7] | 0x07 ST_RETIRED Instruction architecturally executed, condition check pass - store: 
(2 This event is not implemented. 
[6] | 0x06 LD_ RETIRED Instruction architecturally executed, condition check pass - load: 
(2 This event is not implemented. 
[5] | 0x05 L1D_TLB_REFILL L1 Data TLB refill: 
1 This event is implemented. 
[4] | 0x04 L1D_CACHE L1 data cache access: 
1 This event is implemented. 
[3] | @xe3 LID_CACHE_ REFILL L1 data cache refill: 
1 This event is implemented. 
[2] | exe2 L1I TLB_REFILL L1 instruction TLB refill: 
1 This event is implemented. 
[1] | 0x01 L1I CACHE REFILL L1 instruction cache refill: 
1 This event is implemented. 
[0] | exee SW_INCR Instruction architecturally executed, condition check pass - software 
increment: 
1 This event is implemented. 
To access the PMCEIDO_ELO register in AArch64 state, read or write the register with: 
MRS <Xt>, PMCEID@_EL@; Read Performance Monitor Common Event Identification Register @ 
To access the PMCEID0 register in AArch32 state, read or write the CP15 register with: 
MRC p15, ©, <Rt>, c9, c12, 6; Read Performance Monitor Common Event Identification Register @ 
The PMCEIDO_ELO register can be accessed through the external debug interface, offset @xE20. 
11.4.3 Performance Monitors Common Event Identification Register 1 


The PMCEID1_ELO register characteristics are: 


Purpose 


Defines which common architectural and common microarchitectural feature events 
are implemented. 
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Usage This register is accessible as follows: 
constraints 
ELO |EL1 |EL1 | EL2 | EL3 EL3 
(NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config/RO |RO |RO |RO RO 























This register is accessible at ELO when PMUSERENR _ELO.EN is set to 1. 


Configurations The PMCEID1 EL register is architecturally mapped to: 
e The AArch32 register PMCEID1. See //.6.3 Performance Monitors Common 
Event Identification Register I on page 11-445. 
¢ The external register PMCEID1_ELO. 


Attributes PMCEID1_ELO is a 32-bit register. 


The following figure shows the PMCEID1_ELO bit assignments. 


31 10 
em 
CE[32] — 


Figure 11-4 PMCEID1_ELO bit assignments 
The following table shows the PMCEID1_ELO bit assignments. 


Table 11-5 PMCEID1 bit assignments 


Bits | Name | Function 





(31:1] | - Reserved, RESO. 





[0] CE[32] | Common architectural and microarchitectural feature events that can be counted by the PMU event counters. 


For each bit described in the following table, the event is implemented if the bit is set to 1, or not implemented if the 
bit is set to @. 

















Table 11-6 PMU common events 





Bit | Event number | Event mnemonic Description 





[0] | 0x20 L2D_CACHE ALLOCATE | @ This event is not implemented. 














To access the PMCEID1_ELO register: 
MRS <Xt>, PMCEID1_EL@; Read Performance Monitor Common Event Identification Register 1 


The PMCEID1_ELO register can be accessed through the external debug interface, offset @xE24. 
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11.5 AArch32 PMU register summary 


The PMU counters and their associated control registers are accessible in the AArch32 execution state 
from the internal CP15 system register interface with MCR and MRC instructions for 32-bit registers and 
MCRR and MRRC for 64-bit registers. 


The following table gives a summary of the Cortex-A73 PMU registers in the AArch32 execution state. 
For those registers not described in this chapter, see the ARM” Architecture Reference Manual ARMVvé8, 
for ARMv8-A architecture profile. 


See the Table 11-13 Memory-mapped PMU register summary on page 11-447 for a complete list of 
registers that are accessible from the external debug interface. 


Table 11-7 PMU register summary in AArch32 state 





























CRn | Op1 | CRm | Op2 | Name Type | Width | Description 

c9 0 cl2 JO PMCR RW | 32-bit | 11.6.1 Performance Monitors Control Register on page 11-440 

c9 0 cl2 jl PMCNTENSET |RW | 32-bit | Performance Monitors Count Enable Set Register 

c9 0 cl2 |2 PMCNTENCLR |RW_ |32-bit | Performance Monitors Count Enable Clear Register 

c9 0 cl2 |3 PMOVSR RW |32-bit | Performance Monitors Overflow Flag Status Register 

c9 0 cl2 |4 PMSWINC WO _ | 32-bit | Performance Monitors Software Increment Register 

c9 0 cl2 |5 PMSELR RW |32-bit | Performance Monitors Event Counter Selection Register 

c9 0 cl2 |6 PMCEIDO RO | 32-bit | 11.6.2 Performance Monitors Common Event Identification Register 0 


on page 11-442 





c9 0 cl2 |7 PMCEID1 RO | 32-bit | 11.6.3 Performance Monitors Common Event Identification Register 1 
on page 11-445 





c9 0 c13 |0 MCCNTR[31:0] | RW | 32-bit | Performance Monitors Cycle Count Register 





MCCNTR[63:0] | RW | 64-bit 





c9 0 cl3 (| 1 MXEVTYPER |RW_ | 32-bit | Performance Monitors Selected Event Type Register 





MCCFILTR RW | 32-bit | Performance Monitors Cycle Count Filter Register 





c9 0 cl3 |2 MXEVCNTR |RW_ | 32-bit | Performance Monitors Selected Event Count Register 





c9 0 cl4 JO MUSERENR RW |32-bit | Performance Monitors User Enable Register 





c9 0 cl4 jl MINTENSET |RW_ | 32-bit | Performance Monitors Interrupt Enable Set Register 








c9 0 cl4 |3 MOVSSET RW |32-bit | Performance Monitor Overflow Flag Status Set Register 








cl4 |0 c8 0 MEVCNTRO RW | 32-bit | Performance Monitor Event Count Registers 





cl4 |0 c8 1 MEVCNTRI RW | 32-bit 





cl4 |O c8 2 MEVCNTR2 RW | 32-bit 





cl4 |0 c8 3 MEVCNTR3 RW | 32-bit 





cl4 |0 c8 4 MEVCNTR4 RW |32-bit 








P 
P 
P 
P 
P 
P 
P 
c9 0 cl4 |2 PMINTENCLR |RW |32-bit | Performance Monitors Interrupt Enable Clear Register 
P 
P 
P 
P 
P 
P 
P 








cl4 |0 c8 5 MEVCNTRS RW | 32-bit 
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Table 11-7 PMU register summary in AArch32 state (continued) 





















































CRn | Op1 | CRm | Op2 | Name Type | Width | Description 

cl4 |0 c12 JO PMEVTYPERO |RW |32-bit | Performance Monitors Event Type Registers 

cl4 |O cl2 |1 PMEVTYPERI |RW_ | 32-bit 

cl4 |0 cl2 |2 PMEVTYPER2 |RW_ | 32-bit 

cl4 |O cl2 |3 PMEVTYPER3 | RW_ | 32-bit 

cl4 |0 cl2 |4 PMEVTYPER4 |RW_ | 32-bit 

cl4 |O cl2 |5 PMEVTYPERS |RW_ | 32-bit 

cl4 |0 cl5 |7 PMCCFILTR RW | 32-bit | Performance Monitors Cycle Count Filter Register 
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11.6 AArch32 PMU register descriptions 
This section describes the processor PMU registers in AArch32 state. 
11.5 AArch32 PMU register summary on page 11-438 provides cross-references to individual registers. 
This section contains the following subsections: 
¢ 11.6.1 Performance Monitors Control Register on page 11-440. 
¢ 11.6.2 Performance Monitors Common Event Identification Register 0 on page 11-442. 
e 11.6.3 Performance Monitors Common Event Identification Register 1 on page 11-445. 
11.6.1 Performance Monitors Control Register 
The PMCR characteristics are: 
Purpose Provides details of the Performance Monitors implementation, including the number 
of counters implemented, and configures and controls the counters. 
Usage This register is accessible as follows: 
constraints 
ELO ELO EL1 | EL1 | EL2 | EL3 EL3 
(NS) (S) (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
Config-RW | Config-RW | RW |RW |RW | RW RW 
This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 
Configurations PMCR is architecturally mapped to: 
e The AArch64 register PMCR_ELO. See 11.4.1 Performance Monitors Control 
Register on page 11-431. 
¢ The external PMCR_ELO register. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes PMCR is a 32-bit register. 
The following figure shows the PMCR bit assignments. 
24 23 16 15 11 10 76543210 
Figure 11-5 PMCR bit assignments 
The following table shows the PMCR bit assignments. 
Table 11-8 PMCR bit assignments 
Bits |Name_ | Function 
[31:24] | IMP Implementer code. This value is: 
0x41 ARM Limited. 
This is a read-only field. 
[23:16] | IDCODE | Identification code. This value is: 
0x04 Cortex-A73 processor. 
This is a read-only field. 
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Table 11-8 PMCR bit assignments (continued) 





Bits Name Function 





[15:11] |N Number of event counters. 


0x6 Six counters are implemented. 





a 
= 
S 
N 

uo 

1 


Reserved, RESO. 





[6] LC Long cycle count enable. Determines which PMCCNTR_ELO bit generates an overflow recorded in 
PMOVSR[31]. The possible values are: 


(2 Overflow on increment that changes PMCCNTR_ELO[31] from 1 to @. 
1 Overflow on increment that changes PMCCNTR_ELO[63] from 1 to @. 


This bit is read/write. 





[5] DP Disable cycle counter when event counting is prohibited. The possible values of this bit are: 
(2 PMCCNTR, if enabled, counts when event counting is prohibited. 
1 PMCCNTR does not count when event counting is prohibited. 


This bit is read/write. 





[4] X Export enable. This bit permits events to be exported to another debug device, such as a trace macrocell, over an 
event bus. The possible values are: 


(2 Do not export events. 


1 Export events where not prohibited. 


This bit is read/write and does not affect the generation of Performance Monitors interrupts on the nPMUIRQ 





pin. 

[3] D Clock divider. The possible values of this bit are: 
(2 When enabled, PMCCNTR_ELO counts every clock cycle. This is the reset value. 
1 When enabled, PMCCNTR_ELO counts every 64 clock cycles. 


This bit is read/write. 





[2] C Clock counter reset. This bit is WO. The effects of writing to this bit are: 
e No action. 
1 Reset PMCCNTR_ELO to 0. 


This bit is always RESO. 
Note 


Resetting PMCCNTR does not clear the PMCCNTR_ELO overflow bit to @. See the ARM” Architecture Reference 
Manual ARMV8, for ARMv8-A architecture profile for more information. 
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Table 11-8 PMCR bit assignments (continued) 





Bits 


Name Function 





[1] 


Event counter reset. This bit is WO. The effects of writing to this bit are: 
7) No action. 

1 Reset all event counters, not including PMCCNTR_ELO, to ©. 
This bit is always RESO. 


In Non-secure ELO and EL1, a write of 1 to this bit does not reset event counters that MDCR_EL2.HPMN 
reserves for EL2 use. 


In EL2 and EL3, a write of 1 to this bit resets all the event counters. 


Resetting the event counters does not clear any overflow bits to @. 





[0] 





Enable. The possible values of this bit are: 

(2 All counters, including PMCCNTR_ELO, are disabled. 
1 All counters are enabled. 

This bit is read/write. 


In Non-secure ELO and EL1, this bit does not affect the operation of event counters that MDCR_EL2.HPMN 
reserves for EL2 use. 











11.6.2 


To access the PMCR: 


MRC p15, 4, <Rt>, c12, c@, @ ; Read PMCR into Rt 
MCR p15, 4, <Rt>, c12, c@, © ; Write Rt to PMCR 


The PMCR can be accessed through the external debug interface, offset @xE24. 


Performance Monitors Common Event Identification Register 0 


The PMCEID0 register characteristics are: 


Purpose Defines which common architectural and common microarchitectural feature events 


are implemented. 


Usage This register is accessible as follows: 





constraints 
ELO |ELO |EL1 |EL1|EL2|EL3 EL3 


(NS) |(S) | (NS) |(S) (SCR.NS = 1) | (SCR.NS 


= 0) 























Config | Config|]RO |RO |RO |RO RO 








This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 


Configurations The PMCEID0 register is architecturally mapped to: 
e The AArch64 register PMCEIDO_ELO. See //.4.2 Performance Monitors 
Common Event Identification Register 0 on page 11-433. 
¢ The external register PMCEIDO ELO. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes PMCEID0 is a 32-bit register. 


The following figure shows the PMCEIDO bit assignments. 
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31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 10 9 8 76543210 


Figure 11-6 PMCEIDO bit assignments 


The following table shows the PMCEID0 bit assignments with event implemented or not implemented 
when the associated bit is set to 1 or ©. See the ARM® Architecture Reference Manual ARMvé, for 
ARMv8-A architecture profile for more information about these events. 


Table 11-9 PMCEIDO bit assignments 





Bits |Name 


Function 





[31:0] | CE[31:0] 











Common architectural and microarchitectural feature events that can be counted by the PMU event counters. 








Table 11-10 PMU common events 



























































Bit | Event number | Event mnemonic Description 

[31] | @x1F L1ID_CACHE ALLOCATE L1 data cache allocate: 

(2 This event is not implemented. 

[30] | @x1E CHAIN Chain. For odd-numbered counters, counts once for each overflow of the 
preceding even-numbered counter. For even-numbered counters, does not 
count: 

1 This event is implemented. 

[29] | @x1D BUS_CYCLES Bus cycle: 

1 This event is implemented. 

[28] | @x1C TTBR_WRITE_ RETIRED TTBR write, architecturally executed, condition check pass - write to 
translation table base: 

1 This event is implemented. 

[27] | @x1B INST_SPEC Instruction speculatively executed: 

1 This event is implemented. 

[26] | @x1A MEMORY ERROR Local memory error: 

(2 This event is not implemented. 

[25] | 0x19 BUS_ACCESS Bus access: 

1 This event is implemented. 

[24] | 0x18 L2D_CACHE_WB L2 data cache Write-Back: 

1 This event is implemented. 

[23] | 0x17 L2D_CACHE_REFILL L2 data cache refill: 

1 This event is implemented. 

[22] | 0x16 L2D_CACHE L2 data cache access: 

1 This event is implemented. 
ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 11-443 
reserved. 


Non-Confidential 


11 Performance Monitor Unit 
11.6 AArch32 PMU register descriptions 


Table 11-10 PMU common events (continued) 






























































Bit | Event number | Event mnemonic Description 
[21] | 0x15 L1D_CACHE WB L1 data cache Write-Back: 
1 This event is implemented. 
[20] | 0x14 L1L CACHE L1 instruction cache access: 
1 This event is implemented. 
[19] | 0x13 MEM_ACCESS Data memory access: 
1 This event is implemented. 
[18] | 0x12 BR_PRED Predictable branch speculatively executed: 
1 This event is implemented. 
[17] | 0x11 CPU_CYCLES Cycle: 
1 This event is implemented. 
[16] | 0x10 BR_MIS PRED Mispredicted or not predicted branch speculatively executed: 
1 This event is implemented. 
[15] | @xOF UNALIGNED_LDST_RETIRED | Instruction architecturally executed, condition check pass - unaligned load 
or store: 
(2) This event is not implemented. 
[14] | @x@E BR_RETURN_RETIRED Instruction architecturally executed, condition check pass - procedure 
return: 
T This event is implemented. 
[13] | @xeD BR_IMMED RETIRED Instruction architecturally executed - immediate branch: 
1 This event is implemented. 
[12] | exec PC_WRITE_RETIRED Instruction architecturally executed, condition check pass - software 
change of the PC: 
1 This event is implemented. 
[11] | @xeB CID_WRITE_ RETIRED Instruction architecturally executed, condition check pass - write to 
CONTEXTIDR: 
1 This event is implemented. 
[10] | @x@A EXC_RETURN Instruction architecturally executed, condition check pass - exception 
return: 
1 This event is implemented. 
[9] | @xe9 EXC_TAKEN Exception taken: 
1 This event is implemented. 
[8] | xe8 INST_RETIRED Instruction architecturally executed: 


1 This event is implemented. 
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Table 11-10 PMU common events (continued) 



























































Bit | Event number | Event mnemonic Description 

[7] | @x07 ST_RETIRED Instruction architecturally executed, condition check pass - store: 
(2 This event is not implemented. 

[6] | 0x06 LD_RETIRED Instruction architecturally executed, condition check pass - load: 
(2 This event is not implemented. 

[5] | 0x05 L1D_TLB_REFILL L1 Data TLB refill: 
1 This event is implemented. 

[4] | 0x04 L1D_CACHE L1 data cache access: 
1 This event is implemented. 

[3] | @xe3 LID_CACHE_ REFILL L1 data cache refill: 
1 This event is implemented. 

[2] | @xe2 L1I TLB_ REFILL L1 instruction TLB refill: 
1 This event is implemented. 

[1] | 0x01 L1I CACHE _ REFILL L1 instruction cache refill: 
1 This event is implemented. 

[0] | 0x00 SW_INCR Instruction architecturally executed, condition check pass - software 
increment: 
1 This event is implemented. 

To access the PMCEIDO: 
MRC p15,0,<Rt>,c9,c12,6 ; Read PMCEID@ into Rt 
The PMCEIDO register can be accessed through and the external debug interface, offset @xE22. 
11.6.3 Performance Monitors Common Event Identification Register 1 


The PMCEID1 register characteristics are: 


Purpose 


Defines which common architectural and common microarchitectural feature events 
are implemented. 


Usage constraints This register is accessible as follows: 





ELO |EL1 | EL2 
(NS) | (NS) 





Config |RO |RO 

















This register is accessible at ELO when PMUSERENR_ELO.EN is set to 1. 
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Configurations 


Attributes 


PMCEID1 is architecturally mapped to: 
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¢ The AArch32 register PMCEID1 ELO. See //.4.3 Performance Monitors 
Common Event Identification Register 1 on page 11-436. 
¢ The external register PMCEID1 ELO. 


There is one copy of this register that is used in both Secure and Non-secure states. 


PMCEID1 is a 32-bit register. 


The following figure shows the PMCEID1 bit assignments 


31 


RESO f 


CE[32] — 


Figure 11-7 PMCEID1 bit assignments 


The following table shows the PMCEID1 bit assignments. 


Table 11-11 PMCEID1 bit assignments 




















For each bit described in the following table, the event is implemented if the bit is set to 1, or not implemented if the 


bit is set to Q. 


Bits | Name | Function 
[31:1] | RESO 
[0] CE[32] | Common architectural and microarchitectural feature events that can be counted by the PMU event counters. 








Table 11-12 PMU common events 





Bit 


Event number 


Event mnemonic 


Description 





[0] 








0x20 





L2D_CACHE_ALLOCATE 





© This event is not implemented. 








To access the PMCEID1 register: 


MRC p15,0,<Rt>,c9,c12,7 ; Read PMCEID1 into Rt 


The PMCEID1 register can be accessed through the external debug interface, offset @xE24. 
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11.7 Memory-mapped PMU register summary 


The following table shows the PMU registers that are accessible through the external debug interface. 


For those registers not described in this chapter, see the ARM® Architecture Reference Manual ARMv8, 
for ARMv8-A architecture profile. 


Table 11-13 Memory-mapped PMU register summary 











































































































Offset Name Type | Description 

0x000 PMEVCNTRO RW | Performance Monitors Event Count Register 0 
0x004 - - Reserved 

0x008 PMEVCNTRI RW | Performance Monitors Event Count Register 1 
@x@OC - - Reserved 

0x010 PMEVCNTR2 RW | Performance Monitors Event Count Register 2 
0x014 - - Reserved 

0x018 PMEVCNTR3 RW |Performance Monitors Event Count Register 3 
@x@1C - - Reserved 

0x020 PMEVCNTR4 RW | Performance Monitors Event Count Register 4 
0x024 - - Reserved 

0x028 PMEVCNTRS5 RW | Performance Monitors Event Count Register 5 
@x@2C-OxF4 |- - Reserved 

OxOF8 PMCCNTR[31:0] | RW _ | Performance Monitors Cycle Count Register 
OxOFC PMCCNTR[63:32] | RW 

@x100-Ox3FC | - - Reserved 

0x400 PMEVTYPERO RW | Performance Monitors Event Type Register 
0x404 PMEVTYPER1 RW 

0x408 PMEVTYPER2 RW 

0x40C PMEVTYPER3 RW 

0x410 PMEVTYPER4 RW 

0x414 PMEVTYPER5 RW 

0x418 -0x478 | - - Reserved 

0x47C PMCCFILTR RW | Performance Monitors Cycle Count Filter Register 
@x480-OxBFC | - - Reserved 

@xCcee PMCNTENSET RW | Performance Monitors Count Enable Set Register 
@xC@4-OxC1C | - - Reserved 

@xC20 PMCNTENCLR RW | Performance Monitors Count Enable Clear Register 
@xC24-®xC7C | - - Reserved 

@xC8e PMOVSCLR RW | Performance Monitors Overflow Flag Status Register 








@xC84-OxC9C 











Reserved 
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Table 11-13 Memory-mapped PMU register summary (continued) 























































































































Offset Name Type | Description 

@xCA@ PMSWINC WO | Performance Monitors Software Increment Register 

@xCA4-@xCBC | - - Reserved 

@xCCce PMOVSSET RW | Performance Monitors Overflow Flag Status Set Register 

@xCC4-@xDFC | - - Reserved 

@xE@O PMCFGR RO | 11.8.1 Performance Monitors Configuration Register on page 11-449 

OxE04 PMCRh RW | Performance Monitors Control Register 

@xE@8-OxE1C | - - Reserved 

@xE20 PMCEIDO RO | Performance Monitors Common Event Identification Register 0 

@xE24 PMCEID1 RO | Performance Monitors Common Event Identification Register 1 

@xE28-OxFA4 |- - Reserved 

OxFA8 PMDEVAFFO RO | Performance Monitors Device Affinity Register 0, see 4.3.2 Multiprocessor Affinity 

Register on page 4-82 

@xFAC PMDEVAFF1 RO | Performance Monitors Device Affinity Register 1, RESO 

@xFBO PMLAR WO | Performance Monitors Lock Access Register 

OxFB4 PMLSR RO | Performance Monitors Lock Status Register 

@xFB8 PMAUTHSTATUS | RO __ | Performance Monitors Authentication Status Register 

@xFBC PMDEVARCH RO | Performance Monitors Device Architecture Register 

@xFCO-OxFC8 | - - Reserved 

@xFCC PMDEVTYPE RO _ | Performance Monitors Device Type Register 

@xFDO PMPIDR4 RO | Performance Monitors Peripheral Identification Register 4 on page 11-453 

@xFD4 PMPIDRS5 RO | Performance Monitors Peripheral Identification Register 5-7 on page 11-453 

@xFD8 PMPIDR6 RO 

@xFDC PMPIDR7 RO 

OxFE@ PMPIDRO RO | Performance Monitors Peripheral Identification Register 0 on page 11-450 

OxFE4 PMPIDRI RO | Performance Monitors Peripheral Identification Register 1 on page 11-451 

OxFE8 PMPIDR2 RO _ | Performance Monitors Peripheral Identification Register 2 on page 11-451 

@xFEC PMPIDR3 RO | Performance Monitors Peripheral Identification Register 3 on page 11-452 

OxFFO PMCIDRO RO | Performance Monitors Component Identification Register 0 on page 11-454 

OxFF4 PMCIDR1 RO | Performance Monitors Component Identification Register 1 on page 11-454 

OxFF8 PMCIDR2 RO | Performance Monitors Component Identification Register 2 on page 11-455 

@xFFC PMCIDR3 RO | Performance Monitors Component Identification Register 3 on page 11-456 
dh 


This register is distinct from the PMCR system register. It does not have the same value. 
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11.8 Memory-mapped PMU register descriptions 
This section describes the Cortex-A73 processor PMU registers accessible through the memory-mapped 
and debug interfaces. 
Table 11-13 Memory-mapped PMU register summary on page 11-447 provides cross-references to 
individual registers. 
This section contains the following subsections: 
e 11.8.1 Performance Monitors Configuration Register on page 11-449. 
e 11.8.2 Performance Monitors Peripheral Identification Registers on page 11-450. 
e 11.8.3 Performance Monitors Component Identification Registers on page 11-453. 
11.8.1 Performance Monitors Configuration Register 
The PMCFGR characteristics are: 
Purpose Contains PMU specific configuration data. 
Usage constraints The accessibility to the PMCFGR by condition code is: 
Off |DLK | OSLK | EPMAD | SLK | Default 
Error | Error | Error | Error RO |RO 
Configurations The PMCFGR is in the processor power domain. 
Attributes PMCFGBR is a 32-bit register. 
The following figure shows the PMCFGR bit assignments. 
31 17 16 15 14 13 8 7 0 
l eg 
CCD 
EX 
Figure 11-8 PMCFGR bit assignments 
The following table shows the PMCFGR bit assignments. 
Table 11-14 PMCFGR bit assignments 
Bits /Name/Function 
[31:17] | - Reserved, RESO. 
[16] EX Export supported. The value is: 
1 Export is supported. PMCR.EX is read/write. 
[15] CCD | Cycle counter has prescale. The value is: 
1 PMCR.D is read/write. 
[14] CC Dedicated cycle counter supported. This bit is RES1. 
[13:8] | Size | Counter size. The value is: 
@b111111 64-bit counters. 
[7:0] IN Number of event counters. The value is: 
0x06 Six counters. 
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The PMCFGR can be accessed through the external debug interface, offset @xEee. 


11.8.2 Performance Monitors Peripheral Identification Registers 


The Performance Monitors Peripheral Identification Registers provide standard information required for 
all components that conform to the ARM PMUV3 architecture. 


There is a set of eight registers, listed in the following table. 


Table 11-15 Summary of the Performance Monitors Peripheral Identification Registers 





Register | Value | Offset 





MPIDR4 | 0x04 | @xFD@ 





MPIDRS | 0x00 | @xFD4 





MPIDR6 | 0x00 | @xFD8 





MPIDR7 | 0x00 | @xFDC 





MPIDRO | @xD9 | OxFE@ 





MPIDRI | @xB9 | @xFE4 





MPIDR2 | @x@B_ | OxFE8 








MPIDR3 | 0x00 | OxXFEC 

















Only bits[7:0] of each Performance Monitors Peripheral ID Register are used, with bits[31:8] reserved. 
Together, the eight Performance Monitors Peripheral ID Registers define a single 64-bit Peripheral ID. 


Performance Monitors Peripheral Identification Register 0 
The PMPIDRO characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMPIDRO can be accessed through the external debug interface. 


The accessibility to the PMPIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





























z Z = 7 RO |RO 
Configurations The PMPIDR0O is in the Debug power domain. 
Attributes PMPIDRO is a 32-bit register. 
The following figure shows the PMPIDRO bit assignments. 
31 8 7 0 


Figure 11-9 PMPIDRO bit assignments 
The following table shows the PMPIDRO bit assignments. 
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Table 11-16 PMPIDRO bit assignments 




















































































































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:0] | Part_0 | exp9 Least significant byte of the performance monitor part number. 
The PMPIDRO can be accessed through the external debug interface, offset @xFE@. 
Performance Monitors Peripheral Identification Register 1 
The PMPIDRI characteristics are: 
Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMPIDRI can be accessed through the external debug interface. 
The accessibility to the PMPIDR1 by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
so ke he - RO [RO 
Configurations The PMPIDR1 is in the Debug power domain. 
Attributes PMPIDRI is a 32-bit register. 
The following figure shows the PMPIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 11-10 PMPIDR1 bit assignments 
The following table shows the PMPIDR1 bit assignments. 
Table 11-17 PMPIDR1 bit assignments 
Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | DES 0] exp ARM Limited. This is the least significant nibble of JEP106 ID code. 
[3:0] | Part_l | x9 Most significant nibble of the performance monitor part number. 
The PMPIDRI can be accessed through the external debug interface, offset @xFE4. 
Performance Monitors Peripheral Identification Register 2 
The PMPIDR2 characteristics are: 
Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The accessibility to the PMPIDR2 by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
- - - - RO |RO 
The PMPIDR2 can be accessed through the external debug interface. 
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Configurations The PMPIDR2 is in the Debug power domain. 
Attributes PMPIDR2 is a 32-bit register. 


The following figure shows the PMPIDR2 bit assignments. 


31 8.7 432 0 
JEDEC — 


Figure 11-11 PMPIDR2 bit assignments 
The following table shows the PMPIDR2 bit assignments. 


Table 11-18 PMPIDR2 bit assignments 





Bits | Name |Function 











[31:8] | - Reserved, RESO. 
[7:4] | Revision | gx@ r0p0. 
[3] JEDEC | Qb1 Indicates a JEP106 identity code is used. 





[2:0] |DES_1 |@be@11 ARM Limited. The most significant bits of JEP106 ID code. 














The PMPIDR2 can be accessed through the external debug interface, offset @xFE8. 


Performance Monitors Peripheral Identification Register 3 
The PMPIDR3 characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMPIDR3 can be accessed through the external debug interface. 


The accessibility to the PMPIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





























an s i RO [RO 
Configurations The PMPIDR3 is in the Debug power domain. 
Attributes PMPIDR3 is a 32-bit register. 
The following figure shows the PMPIDR3 bit assignments. 
31 8:7 4 3 0 


Figure 11-12 PMPIDR3 bit assignments 
The following table shows the PMPIDR3 bit assignments. 





ARM 100048 0002 _05_ en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 11-452 
reserved. 
Non-Confidential 





11 Performance Monitor Unit 
11.8 Memory-mapped PMU register descriptions 


Table 11-19 PMPIDR3 bit assignments 





Bits 


Name 


Function 





[31:8] 


Reserved, RESO. 





[7:4] 


REVAND | 9x9 Part minor revision. 





[3:0] 





CMOD 


0x0 Customer modified. 











Bits 


Name 


The PMPIDR3 can be accessed through the external debug interface, offset @xFEC. 


Performance Monitors Peripheral Identification Register 4 
The PMPIDR4 characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMPIDR4 can be accessed through the external debug interface. 


The accessibility to the PMPIDR4 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 


























Configurations The PMPIDR4 is in the Debug power domain. 
Attributes PMPIDR4 is a 32-bit register. 


The following figure shows the PMPIDR4 bit assignments. 


31 8 7 4 3 0 


Figure 11-13 PMPIDR4 bit assignments 
The following table shows the PMPIDR4 bit assignments. 


Table 11-20 PMPIDR4 bit assignments 


Function 





[31:8] 


Reserved, RESO. 





[7:4] 


Size 


0x0 Size of the component. RESO. Log, the number of 4KB pages from the start of the component to the end of 
the component ID registers. 





[3:0] 








DES 2 





0x4 ARM Limited. This is the least significant nibble of the JEP106 continuation code. 








11.8.3 


The PMPIDR4 can be accessed through the external debug interface, offset @xFD@. 


Performance Monitors Peripheral Identification Register 5-7 


No information is held in PMPIDR5, PMPIDR6, and PMPIDR7. They are reserved for future use and are 
RESO. 


Performance Monitors Component Identification Registers 


There are four read-only Performance Monitors Component Identification Registers. The following table 
shows these registers. 
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Table 11-21 Summary of the Performance Monitors Component Identification Registers 





Register | Value | Offset 





PMCIDRO | @x@D | OxFF@ 





PMCIDRI1 | 0x90 | OxFF4 





PMCIDR2 | 0x05 | OxFF8 





PMCIDR3 | @xB1 | @xXFFC 

















The Performance Monitors Component Identification Registers identify Performance Monitor as ARM 
PMUV3 architecture. 


Performance Monitors Component Identification Register 0 
The PMCIDRO characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 


Usage constraints The PMCIDRO can be accessed through the external debug interface. 
The accessibility to the PMCIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





























- - - - RO |RO 
Configurations The PMCIDRO is in the Debug power domain. 
Attributes PMCIDR0O is a 32-bit register. 
The following figure shows the PMCIDR0O bit assignments. 
31 8 7 0 


Figure 11-14 PMCIDRO bit assignments 
The following table shows the PMCIDR0O bit assignments. 


Table 11-22 PMCIDRO bit assignments 





Bits 


Name 


Function 





[31:8] 


Reserved, RESO. 





[7:0] 








PRMBL 0| @xep Preamble byte 0. 











The PMCIDRO can be accessed through the external debug interface, offset @xFF®. 


Performance Monitors Component Identification Register 1 
The PMCIDRI characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 
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Usage constraints The PMCIDRI can be accessed through the external debug interface. 
The accessibility to the PMCIDRI by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





























=z z = = RO |RO 
Configurations The PMCIDR1 is in the Debug power domain. 
Attributes PMCIDR1 is a 32-bit register. 
The following figure shows the PMCIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 11-15 PMCIDR1 bit assignments 
The following table shows the PMCIDR1 bit assignments. 


Table 11-23 PMCIDR1 bit assignments 



























































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | CLASS 0x9 Debug component. 
[3:0] | PRMBL_1 | @x@ Preamble byte 1, RESO. 
The PMCIDRI can be accessed through the external debug interface, offset @xFF4. 
Performance Monitors Component Identification Register 2 
The PMCIDR2 characteristics are: 
Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMCIDR? can be accessed through the external debug interface. 
The accessibility to the PMCIDR2 by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
- - - - RO |RO 
Configurations The PMCIDR2 is in the Debug power domain. 
Attributes PMCIDR2 is a 32-bit register. 
The following figure shows the PMCIDR2 bit assignments. 
31 8 7 0 
Figure 11-16 PMCIDR2 bit assignments 
The following table shows the PMCIDR2 bit assignments. 
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Table 11-24 PMCIDR2 bit assignments 





Bits |Name Function 





[31:8] | - Reserved, RESO. 








[7:0] | PRMBL 2 | 9x@5 Preamble byte 2. 

















The PMCIDR2 can be accessed through the external debug interface, offset @xFF8. 


Performance Monitors Component Identification Register 3 
The PMCIDR3 characteristics are: 


Purpose Provides information to identify a Performance Monitor component. 
Usage constraints The PMCIDR3 can be accessed through the external debug interface. 


The accessibility to the PMCIDR3 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





























sile hg - RO |RO 
Configurations The PMCIDR3 is in the Debug power domain. 
Attributes PMCIDR3 is a 32-bit register. 
The following figure shows the PMCIDR3 bit assignments. 
31 8 7 0 


Figure 11-17 PMCIDR3 bit assignments 
The following table shows the PMCIDR3 bit assignments. 


Table 11-25 PMCIDR3 bit assignments 





Bits |Name Function 





[31:8] | - Reserved, RESO. 





[7:0] | PRMBL 3 | @xB1 Preamble byte 3. 














The PMCIDR3 can be accessed through the external debug interface, offset @xFFC. 
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11 Performance Monitor Unit 
11.9 Events 


The following table shows the events that are generated and the numbers that the PMU uses to reference 
the events. The table also shows the bit position of each event on the event bus. Event reference numbers 
that are not listed are reserved. 


Table 11-26 PMU events 































































































Event Event mnemonic PMU event PMU event | Event name 
number bus (to bus (to 
external) trace) 

0x00 SW_INCR = š Software increment. Instruction 
architecturally executed (condition check 
pass). 

0x01 LiL CACHE _ REFILL [0] [0] L1 instruction cache refill. 

0x02 L1I TLB_REFILL [1] [1] L1 instruction TLB refill. 

0x03 L1D_CACHE REFILL [2] [2] L1 data cache refill. 

0x04 LID_CACHE [4:3] [4:3] L1 data cache access. 

0x05 LID TLB_REFILL [5] [5] L1 data TLB refill. 

0x08 INST_RETIRED [16:10] [16:10] Instruction architecturally executed. 

0x09 EXC _ TAKEN [17] [17] Exception taken. 

Ox0A EXC_RETURN [18] [18] Instruction architecturally executed, condition 
code check pass, exception return. 

@x@B CID_WRITE_ RETIRED [19] [19] Instruction architecturally executed, condition 
code check pass, write to CONTEXTIDR. 

@xOC PC_WRITE_RETIRED [21] [21] Instruction architecturally executed, condition 
check pass, software change of the PC. 

@xe@D BR_IMMED_ RETIRED [22] [22] Instruction architecturally executed, 
immediate branch. 

@x@E BR_RETURN_RETIRED [23] [23] Instruction architecturally executed, condition 
code check pass, procedure return.“ 

0x10 BR _ MIS PRED [26] - Mispredicted or not predicted branch 
speculatively executed. 

0x11 CPU_CYCLES - - Cycle. 

0x12 BR_PRED [27] - Predictable branch speculatively executed. 

0x13 MEM_ACCESS [30:28] - Data memory access. 

0x14 L11 CACHE [31] - L1 instruction cache access. 

0x15 LID CACHE WB [32] - L1 data cache Write-Back. 

0x16 L2D_CACHE - - L2 data cache access. 

0x17 L2D_ CACHE _REFILL - - L2 data cache refill. 

0x18 L2D_ CACHE WB - - L2 data cache Write-Back. 














di 


This event is encoded with 7 bits so that it can indicate that up to 127 instructions have been retired. 


dj In addition to the instructions that are counted in this event as specified in the ARMv8 architecture, the Cortex-A73 processor also counts the instruction LDR PC, 


[SP, #offset]. 
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Table 11-26 PMU events (continued) 































































































Event Event mnemonic PMU event PMU event | Event name 

number bus (to bus (to 
external) trace) 

0x19 BUS_ACCESS - - Bus access. 

@x1B INT_SPEC - - Operation speculatively executed. 

@x1C TTBR_WRITE_RETIRED [20] [20] Instruction architecturally executed (condition 
check pass) - Write to TTBR. 

@x1D BUS_CYCLES - - Bus cycle. 

@x1E CHAIN - - For odd-numbered counters, increments the 
count by one for each overflow of the 
preceding even-numbered counter. For even- 
numbered counters there is no increment. 

0x40 LID CACHE RD - - L1 data cache access, read. 

0x41 LID CACHE WR - - L1 data cache access, write. 

0x50 L2D_CACHE_RD - - L2 data cache access, read. 

0x51 L2D_CACHE WR - - L2 data cache access, write. 

0x56 L2D_ CACHE _WB_VICTIM - - L2 data cache write-back, victim. 

0x57 L2D_CACHE_WB_CLEAN - - L2 data cache write-back, cleaning and 
coherency. 

0x58 L2D_CACHE_INVAL - - L2 data cache invalidate. 

0x62 BUS_ACCESS_SHARED - - Bus access, Normal, Cacheable, Shareable. 

0x63 BUS_ACCESS_NOT_SHARED | - - Bus access, not Normal, Cacheable, or 
Shareable. 

0x64 BUS_ACCESS_NORMAL - - Bus access, Normal. 

0x65 BUS_ACCESS_SO_DIV - - Bus access, Device. 

0x66 MEM_ACCESS_RD - - Data memory access, read. 

0x67 MEM_ACCESS_WR - - Data memory access, write. 

Ox6A UNALIGNED LDST_ SPEC [25:24] [25:24] Unaligned access. 

@x6C LDREX_SPEC - - Exclusive operation speculatively executed, 
LDREX, or LDX. 

Ox6E STREX_FAIL SPEC - - Exclusive operation speculatively executed, 
STREX, or STX pass. 

0x70 LD_SPEC [7:6] [7:6] Operation speculatively executed, load. 

@x71 ST_SPEC [9:8] [9:8] Operation speculatively executed, store. 

0x72 LDST_SPEC - - Operation speculatively executed, load or 
store. 

0x73 DP_SPEC - - Operation speculatively executed, integer data 
processing. 

0x74 ASE_SPEC - - Operation speculatively executed, Advanced 
SIMD instruction. 
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Table 11-26 PMU events (continued) 































































































Event Event mnemonic PMU event PMU event | Event name 
number bus (to bus (to 
external) trace) 

0x75 VFP_SPEC - - Operation speculatively executed, floating- 
point instruction. 

0x77 CRYPTO _ SPEC - - Operation speculatively executed, 
Cryptographic instruction. 

0x7A BR_INDIRECT_SPEC - - Branch speculatively executed - Indirect 
branch. 

@x7C ISB_SPEC - - Barrier speculatively executed, ISB. 

@x7D DSB_SPEC - - Barrier speculatively executed, DSB. 

@x7E DMB _ SPEC - - Barrier speculatively executed, DMB. 

Ox8A EXC_HVC - - Exception taken, Hypervisor Call. 

@xCe LF_ STALL - - A linefill caused an instruction side stall. 

@xC1 PTW_STALL - - A translation table walk caused an instruction 
side stall. 

@xC2 I TAG RAM RD - - Number of ways read in the instruction cache 
- Tag RAM. 

@xC3 I DATA RAM RD - - Number of ways read in the instruction cache 
- Data RAM. 

@xCc4 I BTAC RAM RD - - Number of ways read in the instruction BTAC 
RAM. 

@xD3 D_LSU_SLOT_FULL - - Duration for which all slots in the Load-Store 
Unit are busy. 

@xD8 LS _ IQ FULL - - Duration for which all slots in the load-store 
issue queue are busy. 

@xD9 DP_IQ FULL - - Duration for which all slots in the data 
processing issue queue are busy. 

@xDA DE _ IQ FULL - - Duration for which all slots in the Data 
Engine issue queue are busy. 

@xDC EXC_TRAP_ HYP - - Number of Traps to hypervisor. 

@xDE ETM EXT OUTO - - ETM trace unit output 0 

@xDF ETM_EXT_OUT1 - = ETM trace unit output 1 

@xE@ MMU_PTW - - Duration of a translation table walk handled 
by the MMU. 

@xE1 MMU_PTW_ST1 - - Duration of a Stage 1 translation table walk 
handled by the MMU. 

@xE2 MMU_PTW_ST2 - - Duration of a Stage 2 translation table walk 
handled by the MMU. 

@xE3 MMU_PTW_LSU - - Duration of a translation table walk requested 





by the LSU. 
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Table 11-26 PMU events (continued) 
























































Event Event mnemonic PMU event PMU event | Event name 
number bus (to bus (to 
external) trace) 

@xE4 MMU_PTW_ISIDE - - Duration of a translation table walk requested 
by the Instruction Side. 

@xE5 MMU_PTW_PLD - - Duration of a translation table walk requested 
by a Preload instruction or Prefetch request. 

@xE6 MMU_PTW_CP15 - - Duration of a translation table walk requested 
by a CP15 operation (maintenance by MVA 
and VA to PA operations). 

@xE7 PLD_UTLB_REFILL - - Level 1 PLD TLB refill. 

@xE8 CP15_UTLB_REFILL - - Level 1 CP15 TLB refill. 

@xE9 UTLB_FLUSH - - Level 1 TLB flush. 

@xEA TLB_ACCESS - - Level 2 TLB access. 

@xEB TLB_MISS - - Level 2 TLB miss. 

@xEC DCACHE_SELF_HIT_VIPT - - Data cache hit in itself due to VIPT aliasing 
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11.10 Interrupts 


The Cortex-A73 processor asserts the nPMUIRQ signal when an interrupt is generated by the PMU. 
You can route this signal to an external interrupt controller for prioritization and masking. This is the 
only mechanism that signals this interrupt to the core. 


This interrupt is also driven as a trigger input to the CTI. See Chapter 13 Cross Trigger on page 13-526 
for more information. 





ARM 100048 0002 _05 en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 11-461 
reserved. 
Non-Confidential 


11 Performance Monitor Unit 
11.11 Exporting PMU events 


11.11 Exporting PMU events 


This section describes exporting of PMU events. 


This section contains the following subsections: 
e 1.11.1 External hardware on page 11-462. 
e 1.11.2 Debug trace hardware on page 11-462. 


11.11.1 External hardware 


In addition to the counters in the core, some events are exported on the PMUEVENT bus and can be 
connected to external hardware. 


These events are described in Table 11-26 PMU events on page 11-457. 


11.11.2 Debug trace hardware 


Some events are exported to the ETM trace unit or to the Cross Trigger Interface (CTI), to enable the 
events to be monitored. 


These events are described in Table 11-26 PMU events on page 11-457. See Chapter 12 Embedded 
Trace Macrocell on page 12-463 and Chapter 13 Cross Trigger on page 13-526 for more information. 
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Embedded Trace Macrocell 


This chapter describes the Embedded Trace Macrocell (ETM) for the Cortex-A73 processor. 


It contains the following sections: 

¢ 12.1 About the ETM on page 12-464. 

e 12.2 ETM trace unit generation options and resources on page 12-465. 

¢ 12.3 ETM trace unit functional description on page 12-467. 

e 12.4 Reset on page 12-468. 

e 12.5 Modes of operation and execution on page 12-469. 

e 12.6 ETM trace unit register interfaces on page 12-471. 

e 12.7 ETM register summary on page 12-472. 

e 12.8 ETM register descriptions on page 12-476. 

¢ 12.9 Interaction with Debug and Performance Monitoring Unit on page 12-525. 
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12.1 About the ETM 


The Embedded Trace Macrocell (ETM) trace unit is a module that performs real-time instruction flow 
tracing based on the ETMv4 architecture. The ETM is a CoreSight component, and is an integral part of 
the ARM Real-time Debug solution, DS-5 Development Studio. 


See the ARM® Embedded Trace Macrocell Architecture Specification, ETMv4 for more information. 
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12.2 ETM trace unit generation options and resources 


The following table shows the trace generation options implemented in the Cortex-A73 ETM trace unit. 


Table 12-1 ETM trace unit generation options implemented 




















Description Configuration 
Instruction address size in bytes 8 
Data address size in bytes 0 
Data value size in bytes 0 
Virtual Machine ID size in bytes 1 
Context ID size in bytes 4 





Support for conditional instruction tracing 


Not implemented 





Support for tracing of data 


Not implemented 





Support for tracing of load and store instructions as PO elements | Not implemented 















































Support for cycle counting in the instruction trace Implemented 
Support for branch broadcast tracing Implemented 
Exception Levels implemented in Non-secure state EL2, EL1, ELO 
Exception Levels implemented in Secure state EL3, EL1, ELO 
Number of events supported in the trace 4 

Return stack support Implemented 
Tracing of SError exception support Implemented 
Instruction trace cycle counting minimum threshold 4 

Size of Trace ID 7 bits 
Synchronization period support Read-write 
Global timestamp size 64 bits 
Number of cores available for tracing 1 

ATB trigger support Implemented 
Low power behavior override Implemented 
Stall control support Implemented 





Support for no overflows in the trace 





Not implemented 











The following table shows the resources implemented in the Cortex-A73 ETM trace unit. 


Table 12-2 ETM trace unit resources implemented 











Description Configuration 
Number of resource selection pairs implemented 8 
Number of external input selectors implemented 4 





Number of external inputs implemented 


30, 4 CTI + 26 PMU 





Number of counters implemented 


2 
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Table 12-2 ETM trace unit resources implemented (continued) 


















































Description Configuration 
Reduced function counter implemented Not implemented 
Number of sequencer states implemented 4 

Number of Virtual Machine ID comparators implemented | 1 

Number of Context ID comparators implemented 1 

Number of address comparator pairs implemented 4 

Number of single-shot comparator controls 1 

Number of processor comparator inputs implemented 0 

Data address comparisons implemented Not implemented 
Number of data value comparators implemented 0 
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12.3 ETM trace unit functional description 


The following figure shows the main functional blocks of the ETM trace unit. 
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Syncbridge 


¢—ATB—> 








Figure 12-1 ETM functional blocks 


Processor interface block 


This block monitors the behavior of the processor and generates PO elements that are essentially 


executed instructions and exceptions traced in program order. 
Trace generation 


The trace generation block generates various trace packets based on PO elements. 


Filtering and triggering resources 


You can limit the amount of trace data generated by the ETM, through the process of filtering. 
For example, generating trace only in a certain address range. More complicated logic analyzer 


style filtering options are also available. 


The ETM trace unit can also generate a trigger that is a signal to the trace capture device to stop 


capturing trace. 


FIFO 


The trace generated by the ETM trace unit is in a highly-compressed form. The FIFO enables 
trace bursts to be flattened out. When the FIFO becomes full, the FIFO signals an overflow. The 
trace generation logic does not generate any new trace until the FIFO is emptied. This causes a 


gap in the trace when viewed in the debugger. 
Trace out 


Trace from the FIFO is output on the synchronous AMBA ATB interface. 


Syncbridge 


The ATB interface from the trace out block goes through an ATB synchronous bridge. See the 
ARM” AMBA” 4 ATB Protocol Specification ATBv1.0 and ATBv1.1 for information about the 


ATB protocol. 
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12.4 Reset 


The reset for the ETM trace unit is the same as a Cold reset for the processor. The ETM trace unit is not 
reset when Warm reset is applied to the processor so that tracing through warm processor reset is 
possible. 


If the ETM trace unit is reset, tracing stops until the ETM trace unit is reprogrammed and re-enabled. 
However, if the processor is reset using Warm reset, the last few instructions that are provided by the 
processor before the reset might not be traced. 
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12.5 Modes of operation and execution 
This section describes how to control the ETM trace unit programming. 


This section contains the following subsections: 
e 12.5.1 Controlling ETM trace unit programming on page 12-469. 
e 12.5.2 Programming and reading ETM trace unit registers on page 12-470. 


12.5.1 Controlling ETM trace unit programming 


When programming the ETM trace unit registers, you must enable all the changes at the same time. For 
example, if the counter is reprogrammed, it might start to count based on incorrect events, before the 
trigger condition has been correctly set up. 


You must use the ETM trace unit main enable in the TRCPRGCTLR to disable all trace operations 
during programming. See the ARM® Embedded Trace Macrocell Architecture Specification, ETMv4 for 
more information. The following figure shows the procedure that must be used when programming the 


ETM trace unit registers. 
( Stat ) 


y 
Set main enable bit in 
TRCPRGCTLR to 0b0 























$$ 
y 
Read TRCSTATR 
No 









Is TRCSTATR Idle 
0b1? 


Yes 


v 





Program all trace 
registers required 





v 
Set main enable bit in 
TRCPRGCTLR to 0b1 


e— 
y 











Read TRCSTATR 





















Is TRCSTATR Idle 
0b0? 


Yes 


End 


Figure 12-2 Programming ETM trace unit registers 











Note 
The Cortex-A73 processor does not have to be in the Debug state while you program the ETM trace unit 
registers. 
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12.5.2 Programming and reading ETM trace unit registers 


You program and read the ETM trace unit registers using the Debug APB interface. This provides a 
direct method of programming the ETM trace unit. 
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12.6 ETM trace unit register interfaces 
The Cortex-A73 processor only supports the memory-mapped interface for trace registers. 
For more information see 70.10 External debug interface on page 10-412. 
This section contains the following subsections: 
e 12.6.1 Access permissions on page 12-471. 
12.6.1 Access permissions 


See the ARM® Embedded Trace Macrocell Architecture Specification, ETMv4 for information on the 
behaviors on register accesses for different trace unit states and the different access mechanisms. 
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ETM register summary 


This section summarizes the ETM trace unit registers. 


For full descriptions of the ETM trace unit registers, see: 


12.8 ETM register descriptions on page 12-476, for the IMPLEMENTATION DEFINED registers and the 
ARM” Embedded Trace Macrocell Architecture Specification, ETMv4, for the other registers. 





Note 
Access type is described as follows: 
RW Read and write. 
RO Read only. 
wo Write only. 





The following table lists all of the ETM trace unit registers and their offsets from a base address. The 
base address is defined by the system integrator when placing the ETM trace unit in the Debug-APB 
memory map. 


Table 12-3 ETM trace unit register summary 







































































Offset Name Type | Description 

0x000 - - Reserved 

0x004 TRCPRGCTLR RW |Programming Control Register 

0x008 - - Reserved 

@x@@C TRCSTATR RO | Status Register 

0x010 TRCCONFIGR RW | 12.8.1 Trace Configuration Register on page 12-477 
0x014 - - Reserved 

0x018 TRCAUXCTLR RW | 12.8.2 Auxiliary Control Register on page 12-478 

@x@1C - - Reserved 

0x020 TRCEVENTCTLOR | RW |12.8.3 Event Control 0 Register on page 12-480 

0x024 TRCEVENTCTLIR | RW |12.8.4 Event Control 1 Register on page 12-481 

0x028 - - Reserved 

@x@2C TRCSTALLCTLR |RW_ | 12.8.5 Stall Control Register on page 12-482 

0x030 TRCTSCTLR RW | 12.8.6 Global Timestamp Control Register on page 12-483 
0x034 TRCSYNCPR RW | 12.8.7 Synchronization Period Register on page 12-484 
0x038 TRCCCCTLR RW | 12.8.8 Cycle Count Control Register on page 12-484 
@xO3C TRCBBCTLR RW | 12.8.9 Branch Broadcast Control Register on page 12-485 
0x040 TRCTRACEIDR RW | 12.8.10 Trace ID Register on page 12-486 

0x044-0x07C | - - Reserved 

0x080 TRCVICTLR RW | 12.8.11 ViewInst Main Control Register on page 12-486 
0x084 TRCVHECTLR RW | 12.8.12 ViewInst Include-Exclude Control Register on page 12-488 
0x088 TRCVISSCTLR RW |12.8.13 ViewInst Start-Stop Control Register on page 12-489 
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Table 12-3 ETM trace unit register summary (continued) 














































































































Offset Name Type | Description 

@x@8C-Ox@FC | - - Reserved 

0x100 TRCSEQEVRO RW |12.8.14 Sequencer State Transition Control Registers 0-2 on page 12-490 
0x104 TRCSEQEVR1 RW | 12.8.14 Sequencer State Transition Control Registers 0-2 on page 12-490 
0x108 TRCSEQEVR2 RW | 12.8.14 Sequencer State Transition Control Registers 0-2 on page 12-490 
@x10C-0x114 | - - Reserved 

0x118 TRCSEQRSTEVR |RW |12.8.15 Sequencer Reset Control Register on page 12-491 
@x11C TRCSEQSTR RW | 12.8.16 Sequencer State Register on page 12-492 

0x120 TRCEXTINSELR |RW |12.8.17 External Input Select Register on page 12-492 
0x124-0x13C | - - Reserved 

0x140 TRCCNTRLDVRO |RW | /2.8.18 Counter Reload Value Registers 0-1 on page 12-493 
0x144 TRCCNTRLDVRI |RW | /2.8.18 Counter Reload Value Registers 0-1 on page 12-493 
@x148-0x14C | - - Reserved 

0x150 TRCCNTCTLRO RW |12.8.19 Counter Control Register 0 on page 12-493 

0x154 TRCCNTCTLR1 RW | 12.8.20 Counter Control Register 1 on page 12-494 
@x158-0x15C | - - Reserved 

0x160 TRCCNTVRO RW | /2.8.21 Counter Value Registers 0-1 on page 12-496 
0x164 TRCCNTVRI1 RW | 12.8.21 Counter Value Registers 0-1 on page 12-496 
@x168-0x17C | - - Reserved 

0x180 TRCIDR8 RO | 12.8.22 ID Register 8 on page 12-496 

0x184 TRCIDR9 RO | 12.8.23 ID Register 9 on page 12-497 

0x188 TRCIDR10 RO |12.8.24 ID Register 10 on page 12-497 

0x18C TRCIDR11 RO | 2.8.25 ID Register 11 on page 12-498 

0x190 TRCIDR12 RO | 12.8.26 ID Register 12 on page 12-498 

0x194 TRCIDR13 RO | 12.8.27 ID Register 13 on page 12-499 

@x198-0x1BC | - - Reserved 

@x1Ce TCRIMSPECO RW | /2.8.28 Implementation Specific Register 0 on page 12-499 
@x1C4-0x1DC | - - Reserved 

Ox1E@ TRCIDRO RO | 12.8.29 ID Register 0 on page 12-500 

0x1E4 TRCIDR1 RO | 12.8.30 ID Register I on page 12-502 

@x1E8 TRCIDR2 RO | 12.8.31 ID Register 2 on page 12-502 

@x1EC TRCIDR3 RO | 12.8.32 ID Register 3 on page 12-503 

Ox1F@ TRCIDR4 RO | 12.8.33 ID Register 4 on page 12-505 

@x1F4 TRCIDRS RO | 12.8.34 ID Register 5 on page 12-506 








Ox1F8-0x204 | - 








Reserved 
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Table 12-3 ETM trace unit register summary (continued) 














































































































Offset Name Type | Description 

0x208-0x23C | TRCRSCTLRn RW | 12.8.35 Resource Selection Control Registers 2-16 on page 12-507, n is 2-15 
@x240-Ox27C | - - Reserved 

0x280 TRCSSCCRO RW | 12.8.36 Single-Shot Comparator Control Register 0 on page 12-508 
@x284-Ox29C | - - Reserved 

@x2A0 TRCSSCSRO RW | 12.8.37 Single-Shot Comparator Status Register 0 on page 12-509 
@x2A4-Ox2FC | - - Reserved 

0x300 TRCOSLAR WO |OS Lock Access Register 

0x304 TRCOSLSR RO |OS Lock Status Register 

0x308-0x30C | - - Reserved 

0x310 TRCPDCR RW | Power Down Control Register 

0x314 TRCPDSR RO |Power Down Status Register 

0x318-0x3FC | - - Reserved 

0x400-0x438 | TRCACVRn RW | 12.8.38 Address Comparator Value Registers 0-7 on page 12-510[n=0-7] 
@x440-0x47C | - - Reserved 

Qx480-0x4B8 | TRCACATRn RW | 12.8.39 Address Comparator Access Type Registers 0-7 on page 12-511 
@x4CO-Ox5FC | - - Reserved 

0x600 TRCCIDCVRO RW | 12.8.40 Context ID Comparator Value Register 0 on page 12-512 
@x604-0x63F | - - Reserved 

0x640 TRCVMIDCVRO RW | 12.8.41 VMID Comparator Value Register 0 on page 12-513 
@x644-0x67F | - - Reserved 

0x680 TRCCIDCCTLRO |RW |12.8.42 Context ID Comparator Control Register 0 on page 12-513 
0x684-0xEEƏ | - - Reserved 

OxEE4 TRCITATBIDR RW | 12.8.43 Integration ATB Identification Register on page 12-514 
@xEE8 - - Reserved 

OxEEC TRCITIDATAR WO | 12.8.44 Integration Instruction ATB Data Register on page 12-515 
@xEFO - - Reserved 

OxEF4 TRCITIATBINR RO | 12.8.45 Integration Instruction ATB In Register on page 12-516. 
OxEF8 - - Reserved 

OxEFC TRCITIATBOUTR | WO_ | /2.8.46 Integration Instruction ATB Out Register on page 12-517 
OxFee TRCITCTRL RW | 12.8.47 Integration Mode Control Register on page 12-517 
OxFQ4-OxF9C | - - Reserved 

@xFAQ TRCCLAIMSET RW | 12.8.48 Claim Tag Set Register on page 12-518 

@xFA4 TRCCLAIMCLR RW | 12.8.49 Claim Tag Clear Register on page 12-519 

OxFA8 TRCDEVAFFO RO | 12.8.50 Device Affinity Register 0 on page 12-519 
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Table 12-3 ETM trace unit register summary (continued) 













































































Offset Name Type | Description 

OxFAC TRCDEVAFF1 RO | 12.8.51 Device Affinity Register 1 on page 12-520 
OxFBO TRCLAR WO | Software Lock Access Register 

OxFB4 TRCLSR RO | Software Lock Status Register 

OxFB8 TRCAUTHSTATUS | RO | Authentication Status Register 

OxFBC TRCDEVARCH RO _ | Device Architecture Register 

@xFCO-OxFC4 | - - Reserved 

@xFC8 TRCDEVID RO | Device ID Register 

OxFCC TRCDEVTY PE RO | Device Type Register 

@xFD@ TRCPIDR4 RO | Peripheral Identification Register 4 on page 12-524 
@xFD4 TRCPIDRS RO _ | Peripheral Identification Register 5-7 on page 12-524 
@xFD8 TRCPIDR6 RO 

@xFDC TRCPIDR7 RO 

OxFE@ TRCPIDRO RO _ | Peripheral Identification Register 0 on page 12-521 
OxFE4 TRCPIDR1 RO | Peripheral Identification Register 1 on page 12-522 
OxFE8 TRCPIDR2 RO |Peripheral Identification Register 2 on page 12-522 
OxFEC TRCPIDR3 RO |Peripheral Identification Register 3 on page 12-523 
OxFFO TRCCIDRO RO | Component Identification Register 0 

OxFF4 TRCCIDRI1 RO | Component Identification Register 1 

OxFF8 TRCCIDR2 RO | Component Identification Register 2 

@xFFC TRCCIDR3 RO | Component Identification Register 3 
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12.8 ETM register descriptions 
This section describes the implementation-specific ETM trace unit registers in the Cortex-A73 processor. 


Table 12-3 ETM trace unit register summary on page 12-472 provides cross-references to individual 
registers. The ARM” Embedded Trace Macrocell Architecture Specification, ETMv4 describes the other 
ETM trace unit registers. 


This section contains the following subsections: 

¢ 12.8.1 Trace Configuration Register on page 12-477. 

e 12.8.2 Auxiliary Control Register on page 12-478. 

e 12.8.3 Event Control 0 Register on page 12-480. 

¢ 12.8.4 Event Control I Register on page 12-481. 

¢ 12.8.5 Stall Control Register on page 12-482. 

¢ 12.8.6 Global Timestamp Control Register on page 12-483. 

e 12.8.7 Synchronization Period Register on page 12-484. 

e 12.8.8 Cycle Count Control Register on page 12-484. 

¢ 12.8.9 Branch Broadcast Control Register on page 12-485. 

e 12.8.10 Trace ID Register on page 12-486. 

e 12.8.11 ViewInst Main Control Register on page 12-486. 

¢ 12.8.12 ViewInst Include-Exclude Control Register on page 12-488. 
e 12.8.13 ViewInst Start-Stop Control Register on page 12-489. 

e 12.8.14 Sequencer State Transition Control Registers 0-2 on page 12-490. 
e 12.8.15 Sequencer Reset Control Register on page 12-491. 

e 12.8.16 Sequencer State Register on page 12-492. 

e 12.8.17 External Input Select Register on page 12-492. 

e 12.8.18 Counter Reload Value Registers 0-1 on page 12-493. 

e 12.8.19 Counter Control Register 0 on page 12-493. 

e 12.8.20 Counter Control Register I on page 12-494. 

e 12.8.21 Counter Value Registers 0-1 on page 12-496. 

e 12.8.22 ID Register § on page 12-496. 

e 12.8.23 ID Register 9 on page 12-497. 

e 12.8.24 ID Register 10 on page 12-497. 

e 12.8.25 ID Register 11 on page 12-498. 

e 12.8.26 ID Register 12 on page 12-498. 

e 12.8.27 ID Register 13 on page 12-499. 

e 12.8.28 Implementation Specific Register 0 on page 12-499. 

e 12.8.29 ID Register 0 on page 12-500. 

e 12.8.30 ID Register 1 on page 12-502. 

e 12.8.31 ID Register 2 on page 12-502. 

e 12.8.32 ID Register 3 on page 12-503. 

e 12.8.33 ID Register 4 on page 12-505. 

e 12.8.34 ID Register 5 on page 12-506. 

e 12.8.35 Resource Selection Control Registers 2-16 on page 12-507. 
e 12.8.36 Single-Shot Comparator Control Register 0 on page 12-508. 
e 12.8.37 Single-Shot Comparator Status Register 0 on page 12-509. 
e 12.8.38 Address Comparator Value Registers 0-7 on page 12-510. 

e 12.8.39 Address Comparator Access Type Registers 0-7 on page 12-511. 
e 12.8.40 Context ID Comparator Value Register 0 on page 12-512. 

e 12.8.41 VMID Comparator Value Register 0 on page 12-513. 

e 12.8.42 Context ID Comparator Control Register 0 on page 12-513. 
e 12.8.43 Integration ATB Identification Register on page 12-514. 

¢ 12.8.44 Integration Instruction ATB Data Register on page 12-515. 
e 12.8.45 Integration Instruction ATB In Register on page 12-516. 

¢ 12.8.46 Integration Instruction ATB Out Register on page 12-517. 

e 12.8.47 Integration Mode Control Register on page 12-517. 
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e 12.8.48 Claim Tag Set Register on page 12-518. 

e 12.8.49 Claim Tag Clear Register on page 12-519. 

e 12.8.50 Device Affinity Register 0 on page 12-519. 

e 12.8.51 Device Affinity Register 1 on page 12-520. 

e 12.8.52 Peripheral Identification Registers on page 12-521. 






































12.8.1 Trace Configuration Register 
The TRCCONFIGR characteristics are: 
Purpose Controls the tracing options. 
Usage constraints * You must always program this register as part of trace unit initialization. 
e This register only accepts writes when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCCONFIGR bit assignments. 
31 13 12 11 10 876543210 
RS 7 | VMID 7 | RES1 + 
| ae 
RESO 
CCl 
BB 
Figure 12-3 TRCCONFIGR bit assignments 
The following table shows the TRCCONFIGR bit assignments. 
Table 12-4 TRCCONFIGR bit assignments 
Bits |Name | Function 
[31:13] | - Reserved, RESO. 
[12] RS Return stack enable bit. The possible values are: 
(2) Return stack is disabled. 
1 Return stack is enabled. 
[11] TS Global timestamp tracing enable bit. The possible values are: 
e Global timestamp tracing is disabled. 
1 Global timestamp tracing is enabled. TRCTSCTLR controls the insertion of timestamps in the trace. 
[10:8] |- Reserved, RESO. 
[7] VMID | VMID tracing enable bit. The possible values are: 
e VMID tracing is disabled. 
1 VMID tracing is enabled. 
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Table 12-4 TRCCONFIGR bit assignments (continued) 























Bits |Name | Function 
[6] CID | Context ID tracing enable bit. The possible values are: 
e Context ID tracing is disabled. 
1 Context ID tracing is enabled. 
[5] - Reserved, RESO. 
[4] CCI Cycle counting in the instruction trace enable bit. The possible values are: 
(2) Cycle counting in the instruction trace is disabled. 
1 Cycle counting in the instruction trace is enabled. TRCCCCTLR controls the threshold value for cycle 
counting. 
[3] BB Branch broadcast mode enable bit. The possible values are: 
(2 Branch broadcast mode is disabled. 
1 Branch broadcast mode is enabled. TRCBBCTLR controls which regions of memory are enabled to use 
branch broadcasting. 
[2:1] |- Reserved, RESO. 
[0] - Reserved, RES1. 

















The TRCCONFIGR can be accessed through the external debug interface with offset 0x010. 


12.8.2 Auxiliary Control Register 
The TRCAUXCTLR characteristics are: 
Purpose The function of this register is to provide IMPLEMENTATION DEFINED configuration and 
control options. 
Usage constraints This register only accepts writes when the trace unit is disabled. 
Note 


If trace debug tools set the value of this register to nonzero, then it might cause the 
behavior of a trace unit to contradict this architecture specification. 








Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 





Note 


This register is set to zero on a trace unit reset. Resetting this register to zero ensures that none of the 
IMPLEMENTATION DEFINED features are enabled by default, and that the trace unit resets to a known state (an 
ETMvV4 trace unit with no IMPLEMENTATION DEFINED features enabled). 





The following figure shows the TRCAUXCTLR bit assignments. 
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31 876543 2 1 


CIFOVERRIDE Ea) 

INOVFLOWEN 

FLUSHOVERRIDE 
TSIOVERRIDE 
SYNCOVERRIDE 


FRSYNCOVFLOW 
IDLEACKOVERRIDE 








0 





AFREADYOVERRIDE 


Figure 12-4 TRCAUXCTLR bit assignments 
The following table shows the TRCAUXCTLR bit assignments. 


Table 12-5 TRCAUXCTLR bit assignments 


Function 





[31:8] 


Reserved, RESO. 





CIFOVERRIDE 


Override core interface register repeater clock enable. The possible values are: 


e Core interface clock gate is enabled. 


1 Core interface clock gate is disabled. 





INOVFLOWEN 


Allow overflows of the core interface buffer, removing any rare impact that the trace unit might 
on the core's speculation when enabled. The possible values are: 


(7) Core interface buffer overflows are disabled. 


1 Core interface buffer overflows are enabled. 


When this bit is set to 1, the trace start/stop logic might deviate from architecturally-specified 
behavior. 


have 





[5] 


FLUSHOVERRIDE 


Override ETM flush behavior. The possible values are: 


(2) ETM trace unit FIFO is flushed and ETM trace unit enters idle state when DBGEN or 
NIDEN is LOW. 


1 ETM trace unit FIFO is not flushed and ETM trace unit does not enter idle state when 
DBGEN or NIDEN is LOW. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 





[4] 


TSIOVERRIDE 


Override TS packet insertion behavior. The possible values are: 


e Timestamp packets are inserted into FIFO when trace activity is LOW. 


1 Timestamp packets are inserted into FIFO irrespective of trace activity. 





[3] 








SYNCOVERRIDE 





Override SYNC packet insertion behavior. The possible values are: 


e SYNC packets are inserted into FIFO when trace activity is LOW. 
1 SYNC packets are inserted into FIFO irrespective of trace activity. 
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Table 12-5 TRCAUXCTLR bit assignments (continued) 





Bits 


Name 


Function 





[2] 


FRSYNCOVFLOW Force overflows to output synchronization packets. The possible values are: 


(2] No FIFO overflow when SYNC packets are delayed. 
1 Forces FIFO overflow when SYNC packets are delayed. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 





[1] 


IDLEACKOVERRIDE | Force ETM idle acknowledge. The possible values are: 


e ETM trace unit idle acknowledge is asserted only when the ETM trace unit is in idle state. 


1 ETM trace unit idle acknowledge is asserted irrespective of the ETM trace unit idle state. 


When this bit is set to 1, trace unit behavior deviates from architecturally-specified behavior. 


























[0] AFREADYOVERRIDE | Force assertion of AFREADYM output. The possible values are: 
(2] ETM trace unit AFREADYM output is asserted HIGH only when the ETM trace unit is 
in idle state or when all the trace bytes in FIFO before a flush request are output. 
1 ETM trace unit AFREADYM output is always asserted HIGH. 
When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 
The TRCAUXCTLR can be accessed through the external debug interface with offset 0x018. 
12.8.3 Event Control 0 Register 
The TRCEVENTCTLOR characteristics are: 
Purpose Controls the tracing of events in the trace stream. The events also drive the external 
outputs from the ETM trace unit. The events are selected from the Resource 
Selectors. 
Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCEVENTCTLOR bit assignments. 
3130 2827 242322 2019 16 15 14 12 11 8 7 6 
L_TYPE3 TYPE2— TYPE1— TYPEO— 
Figure 12-5 TRCEVENTCTLOR bit assignments 
The following table shows the TRCEVENTCTLOR bit assignments. 
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Table 12-6 TRCEVENTCTLOR bit assignments 





Bits 


Name 


Function 





[31] 


TYPE3 


Selects the resource type for trace event 3: 


[3] Single selected resource. 


1 Boolean combined resource pair. 





[30:28] 


Reserved, RESO. 





[27:24] 


SEL3 


Selects the resource number, based on the value of TYPE3: 
When TYPE3 is ©, SEL3 selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE3 is 1, SEL3 selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 





[23] 


TYPE2 


Selects the resource type for trace event 2: 


[3] Single selected resource. 


1 Boolean combined resource pair. 





[22:20] 


Reserved, RESO. 





[19:16] 


SEL2 


Selects the resource number, based on the value of TYPE2: 
When TYPE2 is ©, SEL2 selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE2 is 1, SEL2 selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 





[15] 


TYPE] 


Selects the resource type for trace event 1: 


[3] Single selected resource. 


1 Boolean combined resource pair. 





[14:12] 


Reserved, RESO. 





[11:8] 


SEL1 


Selects the resource number, based on the value of TYPE1: 
When TYPE! is 0, SEL1 selects a single selected resource from 0-15 defined by bits[3:0]. 
When TYPE] is 1, SEL1 selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 





[7] 


TYPEO 


Selects the resource type for trace event 0: 


[3] Single selected resource. 


1 Boolean combined resource pair. 





[6:4] 


Reserved, RESO. 





[3:0] 








SELO 





Selects the resource number, based on the value of TYPEO: 
When TYPE is @, selects a single selected resource from 0-15 defined by bits[3:0]. 


When TYPEO is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 








12.8.4 


The TRCEVENTCTLOR can be accessed through the external debug interface, offset 0x020. 


Event Control 1 Register 


The TRCEVENTCTLIR characteristics are: 
Purpose Controls the behavior of the events that TRCEVENTCTLOR selects. 


Usage constraints * You must always program this register as part of trace unit initialization. 


e Accepts writes only when the trace unit is disabled. 
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Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCEVENTCTLIR bit assignments. 


31 13 12 11 10 8 7 5 4 3 0 


mm s e] 
ATB 
LPOVERRIDE 


Figure 12-6 TRCEVENTCTL1R bit assignments 
The following table shows the TRCEVENTCTLIR bit assignments. 


Table 12-7 TRCEVENTCTL1R bit assignments 





Bits 


Name 


Function 





[31:13] 


Reserved, RESO. 





[12] 


LPOVERRIDE | Low power state behavior override: 


(2 Low power state behavior unaffected. 


1 Low power state behavior overridden. The resources and Event trace generation are unaffected 
by entry to a low power state. 





[11] 


ATB 


ATB trigger enable: 


(3] ATB trigger disabled. 
1 ATB trigger enabled. 





[10:4] 


Reserved, RESO. 





[3:0] 








EN 


One bit per event, to enable generation of an event element in the instruction trace stream when the selected 
event occurs: 


(2) Event does not cause an event element. 


1 Event causes an event element. 








12.8.5 


The TRCEVENTCTLIR can be accessed through the external debug interface, offset 0x024. 


Stall Control Register 


The TRCSTALLCTLR characteristics are: 


Purpose Enables the ETM trace unit to stall the Cortex-A73 processor if the ETM trace unit 
FIFO overflows. 
Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCSTALLCTLR bit assignments. 
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Figure 12-7 TRCSTALLCTLR bit assignments 
The following table shows the TRCSTALLCTLR bit assignments. 


Table 12-8 TRCSTALLCTLR bit assignments 



































Bits |Name | Function 
[31:9] | - Reserved, RESO. 
[8] ISTALL | Instruction stall bit. Controls if the trace unit can stall the processor when the instruction trace buffer space is less 
than LEVEL: 
7) The trace unit does not stall the processor. 
1 The trace unit can stall the processor. 
[7:4] |- Reserved, RESO. 
[3:2] | LEVEL | Threshold level field. The field can support four monotonic levels from @b@@ to @b11, where: 
e@bee Zero invasion. This setting has a greater risk of an ETM trace unit FIFO overflow. 
@b11 Maximum invasion occurs but there is less risk of a FIFO overflow. 
[1:0] |- Reserved, RESO. 
The TRCSTALLCTLR can be accessed through the external debug interface, offset @x@2C. 
12.8.6 Global Timestamp Control Register 
The TRCTSCTLR characteristics are: 
Purpose Controls the insertion of global timestamps in the trace streams. When the selected 
event is triggered, the trace unit inserts a global timestamp into the trace streams. 
The event is selected from one of the Resource Selectors. 
Usage constraints * This register accepts writes only when the trace unit is disabled. 
e Must be programmed if TRCCONFIGR.TS == 1. 
Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCTSCTLR bit assignments: 
31 8 7 6 4 3 0 
mm fem see | 
L_TYPE 
Figure 12-8 TRCTSCTLR bit assignments 
The following table shows the TRCTSCTLR bit assignments: 
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Table 12-9 TRCTSCTLR bit assignments 





Bits | Name | Function 











[31:8] | - Reserved, RESO. 
[7] TYPE | Single or combined resource selector. 
[6:4] |- Reserved, RESO. 

















[3:0] | SEL _ | Identifies the resource selector to use. 





The TRCTSCTLR can be accessed through the external debug interface, offset 0x030. 


Synchronization Period Register 


The TRCSYNCPR characteristics are: 


Purpose Controls how often periodic trace synchronization requests occur. 


Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 


Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCSYNCPR bit assignments. 


31 5 4 0 


Figure 12-9 TRCSYNCPR bit assignments 
The following table shows the TRCSYNCPR bit assignments. 


Table 12-10 TRCSYNCPR bit assignments 





Bits 


Name 


Function 





[31:5] 


Reserved, RESO. 





[4:0] 








PERIOD 





Defines the number of bytes of trace between synchronization requests as a total of the number of bytes generated 

by both the instruction and data streams. The number of bytes is 2N where N is the value of this field: 

e A value of zero disables these periodic synchronization requests, but does not disable other synchronization 
requests. 

¢ The minimum value that can be programmed, other than 0b00@Q, is 0b01008, providing a minimum 
synchronization period of 256 bytes. 

* The maximum value is @b1010@, providing a maximum synchronization period of 27° bytes. 








12.8.8 


The TRCSYNCPR can be accessed through the external debug interface, offset 0x034. 


Cycle Count Control Register 


The TRCCCCTLR characteristics are: 


Purpose Sets the threshold value for cycle counting. 


Usage constraints * This register accepts writes only when the trace unit is disabled. 
e You must program this register if TRCCONFIGR.CCI == 1. 


Configurations Available in all configurations. 
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Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCCCTLR bit assignments. 
31 12 11 0 


Figure 12-10 TRCCCCTLR bit assignments 
The following table shows the TRCCCCTLR bit assignments. 


Table 12-11 TRCCCCTLR bit assignments 





Bits 


Name 


Function 





[31:12] 


Reserved, RESO. 





[11:0] 





THRESHOLD | Sets the threshold value for instruction trace cycle counting. The minimum threshold value that can be 


programmed into THRESHOLD is 4, as given in TRCIDR3.CCITMIN. See ARM® ETM Architecture 
Specification, ETMv4 for more information. 











12.8.9 


The TRCCCCTLR can be accessed through the external debug interface, offset 0x038. 


Branch Broadcast Control Register 


The TRCBBCTLR characteristics are: 
Purpose Controls which regions in the memory map are enabled to use branch broadcasting. 


Usage constraints * This register only accepts writes when the trace unit is disabled. 
e You must program this register if TRCCONFIGR.BB == 1. 


Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCBBCTLR bit assignments. 
31 98 7 0 


ee eee 
L— MODE 
Figure 12-11 TRCBBCTLR bit assignments 


The following table shows the TRCBBCTLR bit assignments. 
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Table 12-12 TRCBBCTLR bit assignments 





Bits |Name_ | Function 





[31:9] Reserved, RESO. 





[8] MODE | Mode bit: 

7) Exclude mode. Branch broadcasting is not enabled in the address range that RANGE defines. 
If RANGE==@ then branch broadcasting is enabled for the entire memory map. 

1 Include mode. Branch broadcasting is enabled in the address range that RANGE defines. 


If RANGE==@ then the behavior of the trace unit is CONSTRAINED UNPREDICTABLE. That is, the trace unit 
might or might not consider any instructions to be in a branch broadcast region. 





[7:0] | RANGE | Address range field. Selects which address range comparator pairs are in use with branch broadcasting. Each bit 
represents an address range comparator pair, so bit[n] controls the selection of address range comparator pair n. If 


bit[n] is: 
7) The address range that address range comparator pair n defines, is not selected. 
1 The address range that address range comparator pair n defines, is selected. 

















The TRCBBCTLR can be accessed through the external debug interface, offset @x@3C. 


12.8.10 Trace ID Register 
The TRCTRACEIDR characteristics are: 


Purpose Sets the trace ID for instruction trace. 


Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 


Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCTRACEIDR bit assignments. 


31 7 6 0 


Figure 12-12 TRCTRACEIDR bit Assignments 
The following table shows the TRCTRACEIDR bit assignments. 


Table 12-13 TRCTRACEIDR bit assignments 





Bits |Name Function 





(31:7] | - Reserved, RESO. 





[6:0] | TRACEID | Trace ID field. Sets the trace ID value for instruction trace. 

















The TRCTRACEIDR can be accessed through the external debug interface, offset 0x049. 


12.8.11 Viewlnst Main Control Register 
The TRCVICTLR characteristics are: 





Purpose Controls instruction trace filtering. 
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Usage constraints This register: 
e Accepts writes only when the trace unit is disabled. 
e Returns stable data only when TRCSTATR.PMSTABLE == 
e Must be programmed, particularly to set the value of the SSSTATUS bit, that 
sets the state of the start-stop logic. 


Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCVICTLR bit assignments. 


31 24 23 20 19 16 15 1211109 8 7 6 
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Figure 12-13 TRCVICTLR bit assignments 
The following table shows the TRCVICTLR bit assignments. 


Table 12-14 TRCVICTLR bit assignments 
































Bits Name Function 
[31:24] | - Reserved, RESO. 
[23:20] | EXLEVEL_NS | In Non-secure state, each bit controls whether instruction tracing is enabled for the corresponding Exception 
level: 
(2) The trace unit generates instruction trace, in Non-secure state, for Exception level n. 
1 The trace unit does not generate instruction trace, in Non-secure state, for Exception level n. 
Note 
The Exception levels are: 
Bit[20] Exception level 0. 
Bit[21] Exception level 1. 
Bit[22] Exception level 2. 
Bit[23] RESO. Instruction tracing is not implemented for Exception level 3. 
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Table 12-14 TRCVICTLR bit assignments (continued) 





Bits Name Function 





[19:16] | EXLEVEL S_ | In Secure state, each bit controls whether instruction tracing is enabled for the corresponding Exception 


level: 
(2) The trace unit generates instruction trace, in Secure state, for Exception level n. 
1 The trace unit does not generate instruction trace, in Secure state, for Exception level n. 


Note 


The Exception levels are: 





Bit[16] Exception level 0. 
Bit[17] Exception level 1. 
Bit[18] RESO. Instruction tracing is not implemented for Exception level 2. 
Bit[19] Exception level 3. 











[15:12] | - Reserved, RESO. 
[11] TRCERR Controls whether a trace unit must trace a System error exception: 
(2 The trace unit does not trace a System error unless it traces the exception or instruction 


immediately prior to the System error exception. 


1 The trace unit always traces a System error, regardless of the value of ViewInst. 





[10] TRCRESET Controls whether a trace unit must trace a Reset exception: 


(2 The trace unit does not trace a Reset exception unless it traces the exception or instruction 
immediately prior to the Reset exception. 

















1 The trace unit always traces a Reset exception. 
[9] SSSTATUS Indicates the current status of the start-stop logic: 
(3] The start-stop logic is in the stopped state. 
1 The start-stop logic is in the started state. 
[8] - Reserved, RESO. 
[7] TYPE Selects the resource type for the ViewInst event: 
7) Single selected resource. 
1 Boolean combined resource pair. 
[6:4] l- Reserved, RESO. 
[3:0] SEL Selects the resource number to use for the ViewInst event, based on the value of TYPE: 


e When TYPE is 9, SEL selects a single selected resource from 0-15 defined by bits[3:0]. 
e When TYPE is 1, SEL selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 














The TRCVICTLR can be accessed through the external debug interface, offset 0x080. 


12.8.12  Viewlnst Include-Exclude Control Register 
The TRCVIIECTLR characteristics are: 





Purpose Defines the address range comparators that control the ViewInst Include/Exclude 
control. 
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Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 


Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCVIECTLR bit assignments. 


31 20 19 16 15 4 3 0 


Figure 12-14 TRCVIIECTLR bit assignments 
The following table shows the TRCVIIECTLR bit assignments. 


Table 12-15 TRCVIIECTLR bit assignments 
































Bits /Name Function 
[31:20] | - Reserved, RESO. 
[19:16] | EXCLUDE | Defines the address range comparators for ViewInst exclude control. One bit is provided for each implemented 
address range comparator. 
[15:4] |- Reserved, RESO. 
[3:0] INCLUDE | Defines the address range comparators for ViewInst include control. 
Not selecting any include comparators indicates that all instructions must be included. The exclude control 
indicates which ranges must be excluded. 
One bit is provided for each implemented address range comparator. 
The TRCVIIECTLR can be accessed through the external debug interface, offset 0x084. 
12.8.13 Viewlnst Start-Stop Control Register 
The TRCVISSCTLR characteristics are: 
Purpose Defines the single address comparators that control the ViewInst Start-Stop logic. 
Usage constraints * You must always program this register as part of trace unit initialization. 
e This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCVISSCTLR bit assignments. 
31 24 23 16:15 8 7 0 
Figure 12-15 TRCVISSCTLR bit assignments 
The following table shows the TRCVISSCTLR bit assignments. 
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Table 12-16 TRCVISSCTLR bit assignments 





Bits Name | Function 





[31:24] | - Reserved, RESO. 





[23:16] | STOP | Defines the single address comparators to stop trace with the ViewInst Start-Stop control. 


One bit is provided for each implemented single address comparator. 





[15:8] |- Reserved, RESO. 





[7:0] START | Defines the single address comparators to start trace with the ViewInst Start-Stop control. 








One bit is provided for each implemented single address comparator. 











The TRCVISSCTLR can be accessed through the external debug interface, offset 0x088. 


Sequencer State Transition Control Registers 0-2 


Name 


The TRCSEQEVRn characteristics are: 


Purpose Defines the sequencer transitions that progress to the next state or backwards to the 
previous state. The ETM trace unit implements a sequencer state machine with up to 
four states. 


Usage constraints * These registers accept writes only when the trace unit is disabled. 
e Return stable data only when TRCSTATR.PMSTABLE = 1. 
¢ Software must use these registers to set the initial state of the sequencer before 
the sequencer is used. 


Configurations Available in all configurations. 


Attributes 32-bit RW registers. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCSEQEVRn bit assignments. 


31 161514 1211 876 43 0 
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Figure 12-16 TRCSEQEVRn bit assignments 
The following table shows the TRCSEQEVRn bit assignments. 


Table 12-17 TRCSEQEVRnh bit assignments 


Function 





[31:16] 


Reserved, RESO. 





[15] 


B TYPE 


Selects the resource type to move backwards to this state from the next state: 


(2) Single selected resource. 


1 Boolean combined resource pair. 





[14:12] 


Reserved, RESO 





[11:8] 








B SEL 


Selects the resource number, based on the value of B TYPE: 
When B TYPE is @, selects a single selected resource from 0-15 defined by bits[3:0]. 


When B TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
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Table 12-17 TRCSEQEVRn bit assignments (continued) 









































Bits |Name_ | Function 
[7] F TYPE | Selects the resource type to move forwards from this state to the next state: 
(2) Single selected resource. 
1 Boolean combined resource pair. 
[6:4] |- Reserved, RESO. 
[3:0] |FSEL | Selects the resource number, based on the value of F TYPE: 
When F TYPE is 0, selects a single selected resource from 0-15 defined by bits[3:0]. 
When F TYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCSEQEVRn registers can be accessed through the external debug interface with offset 0x100 for 
TRCSEQEVRO, 0x104 for TRCSEQEVR1, and 0x108 for TRCSEQEVR2. 
12.8.15 Sequencer Reset Control Register 
The TRCSEQRSTEVR characteristics are: 
Purpose Moves the sequencer to state 0 when a programmed event occurs. 
Usage constraints * This register accepts writes only when the trace unit is disabled. 
e Ifthe sequencer is used, you must program all sequencer state transitions with a 
valid event. 
Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCSEQRSTEVR bit assignments. 
31 8 7 6 4 3 0 
| | ret fren 
RESETTYPE— 
Figure 12-17 TRCSEQRSTEVR bit assignments 
The following table shows the TRCSEQRSTEVR bit assignments. 
Table 12-18 TRCSEQRSTEVR bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7] RESETTYPE | Selects the resource type to move back to state 0: 
(2) Single selected resource. 
1 Boolean combined resource pair. 
[6:4] |- Reserved, RESO. 
[3:0] | RESETSEL | Selects the resource number, based on the value of RESETTYPE: 








When RESETTYPE is 0, RESETSEL selects a single selected resource from 0-15 defined by bits[3:0]. 
When RESETTYPE is 1, RESETSEL selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
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The TRCSEQRSTEVR can be accessed through the external debug interface, offset 0x118. 


12.8.16 | Sequencer State Register 
The TRCSEQSTR characteristics are: 


Purpose Use this register to set or read the sequencer state. 


Usage constraints * This register accepts writes only when the trace unit is disabled. 
e Returns stable data only when TRCSTATR.PMSTABLE = 1. 
¢ Software must use this register to set the initial state of the sequencer before the 
sequencer is used. 


Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCSEQSTR bit assignments. 


31 2 1 0 
mid 
STATE —! 


Figure 12-18 TRCSEQSTR bit assignments 
The following table shows the TRCSEQSTR bit assignments. 


Table 12-19 TRCSEQSTR bit assignments 





Bits | Name | Function 





[31:2] Reserved, RESO. 





[1:0] | STATE | Sets or returns the current sequencer state: 
@bee State 0. 
@be1 State 1. 
Qb10 State 2. 
@b11 State 3. 

















The TRCSEQSTR can be accessed through the external debug interface, offset @x11c. 


12.8.17 External Input Select Register 
The TRCEXTINSELR characteristics are: 


Purpose Use this register to set, or read, which external inputs are resources to the trace unit. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCEXTINSELR bit assignments. 


29 28 2423 2120 1615 1312 


Figure 12-19 TRCEXTINSELR bit assignments 
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The following table shows the TRCEXTINSELR bit assignments. 


Table 12-20 TRCEXTINSELR bit assignments 





Bits Name | Function 





[31:29] | - Reserved, RESO. 





[28:24] | SEL3 | Selects an event from the external input bus for External Input Resource 3. 





[23:21] | - Reserved, RESO. 





[20:16] | SEL2 | Selects an event from the external input bus for External Input Resource 2. 





[15:13] | - Reserved, RESO. 





[12:8] | SEL1 | Selects an event from the external input bus for External Input Resource 1. 





[7:5] |- Reserved, RESO. 





[4:0] SELO | Selects an event from the external input bus for External Input Resource 0. 

















The TRCEXTINSELR can be accessed through the external debug interface, offset 0x120. 





























12.8.18 | Counter Reload Value Registers 0-1 
The TRCCNTRLDVRn characteristics are: 
Purpose Defines the reload value for the counter. 
Usage constraints These registers accept writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes Both are 32-bit RW trace registers. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 
The following figure shows the TRCCNTRLDVRn bit assignments. 
31 16:15 0 
Figure 12-20 TRCCNTRLDVRn bit assignments 
The following table shows the TRCCNTRLDVRn bit assignments. 
Table 12-21 TRCCNTRLDVRn bit assignments 
Bits | Value | Function 
[31:16] | - Reserved, RESO. 
[15:0] | VALUE | Defines the reload value for the counter. This value is loaded into the counter each time the reload event occurs. 
The TRCCNTRLDVRn registers can be accessed through external debug interface with offset 0x149 for 
TRCCNTRLDVRO and 0x144 for TRCCNTRLDVRI. 
12.8.19 | Counter Control Register 0 
The TRCCNTCTLRO characteristics are: 
Purpose Controls the operation of counter 0. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
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Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCNTCTLR0O bit assignments. 


31 17161514 1211 8 7 6 
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Figure 12-21 TRCCNTCTLRO bit assignments 
The following table shows the TRCCNTCTLRO bit assignments. 


Table 12-22 TRCCNTCTLRO bit assignments 





Bits 


Name 


Function 





[31:17] 


Reserved, RESO. 





[16] 


RLDSELF | Controls whether a reload event occurs for counter 0, when counter 0 reaches zero: 


(2) Counter 0 is in Normal mode. 


1 Counter 0 is in Self-reload mode. 





[15] 


RLDTYPE | Selects the resource type for the reload: 


(3 Single selected resource. 


1 Boolean combined resource pair. 





[14:12] 


Reserved, RESO. 





[11:8] 


RLDSEL | Selects the resource number, based on the value of RLDTYPE: 


When RLDTYPE is 0, RLDSEL selects a single selected resource from 0-15 defined by bits[3:0]. 
When RLDTYPE is 1, RLDSEL selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 





[7] 


CNTTYPE | Selects the resource type for the counter: 


) Single selected resource. 


1 Boolean combined resource pair. 





[6:4] 


Reserved, RESO. 





[3:0] 





CNTSEL | Selects the resource number, based on the value of CNTTYPE: 


When CNTTYPE is 8, CNTSEL selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, CNTSEL selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 











12.8.20 


The TRCCNTCTLRO can be accessed through the external debug interface, offset 0x150. 


Counter Control Register 1 


The TRCCNTCTLRI characteristics are: 


Purpose Controls the operation of counter 1. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
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The following figure shows the TRCCNTCTLRI bit assignments. 


31 1817161514 12:11 8 7 6 
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Figure 12-22 TRCCNTCTLR1 bit assignments 
The following table shows the TRCCNTCTLRI bit assignments. 


Table 12-23 TRCCNTCTLR1 bit assignments 


















































Bits |Name Function 
[31:18] | - Reserved, RESO. 
[17] CNTCHAIN | Controls whether counter 1 decrements when a reload event occurs for counter 1. This enables two counters to 
be used in combination to provide a larger counter: 
[3] Counter 1 does not decrement when a reload event for counter 0 occurs. Counter 1 operates 
independently from counter 0. 
1 Counter 0 decrements when a reload event for counter 0 occurs. This concatenates counter 0 and 
counter 1 to provide a larger count value. 
[16] RLDSELF | Controls whether a reload event occurs for counter 1, when counter 1 reaches zero: 
) The counter does not reload when it reaches zero. The counter only reloads based on RLDTYPE 
and RLDSEL. 
1 The counter reloads when it is zero and the resource selected by CNTTYPE and CNTSEL is also 
active. The counter also reloads based on RLDTYPE and RLDSEL. 
[15] RLDTYPE | Selects the resource type for the reload: 
) Single selected resource. 
1 Boolean combined resource pair. 
[14:12] | - Reserved, RESO. 
[11:8] | RLDSEL Selects the resource number, based on the value of RLDTYPE: 
When RLDTYPE is 0, RLDSEL selects a single selected resource from 0-15 defined by bits[3:0]. 
When RLDTYPE is 1, RLDSEL selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
[7] CNTTYPE | Selects the resource type for the counter: 
) Single selected resource. 
1 Boolean combined resource pair. 
[6:4] - Reserved, RESO. 
[3:0] | CNTSEL Selects the resource number, based on the value of CNTTYPE: 
When CNTTYPE is 8, selects a single selected resource from 0-15 defined by bits[3:0]. 
When CNTTYPE is 1, selects a Boolean combined resource pair from 0-7 defined by bits[2:0]. 
The TRCCNTCTLRI can be accessed through the external debug interface, offset 0x154. 
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12.8.21 Counter Value Registers 0-1 
The TRCCNTVRn characteristics are: 


Purpose Contains the current counter value. 


Usage constraints * These registers only accept writes when the ETM trace unit is disabled. 
¢ The count value is stable only when TRCSTATR.PMSTABLE = 1. 
e Ifsoftware uses counter 0 or 1, then it must write to this register to set the initial 
counter value. 


Configurations Available in all configurations. 


Attributes Both are 32-bit RW registers. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCNTVRn bit assignments. 


31 1615 0 


Figure 12-23 TRCCNTVRn bit assignments 
The following table shows the TRCCNTVRn bit assignments. 


Table 12-24 TRCCNTVRn bit assignments 





Bits Value | Function 





[31:16] | - Reserved, RESO. 








[15:0] | VALUE | Contains the current counter value. 











The TRCCNTVRn registers can be accessed through the external debug interface with offset 0x160 for 
TRCCNTVRO and 0x164 for TRCCNTVRI. 

12.8.22 ID Register 8 
The TRCIDR8 characteristics are: 


Purpose Returns the maximum speculation depth of the instruction trace stream. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDR8 bit assignments. 


31 0 


MAXSPEC 


Figure 12-24 TRCIDR8 bit assignments 
The following table shows the TRCIDR8 bit assignments. 
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Table 12-25 TRCIDR8 bit assignments 





Bits | Name Function 





[31:0] | MAXSPEC | Indicates the maximum speculation depth of the instruction stream. This is the maximum number of PO elements 
in the trace stream that can be speculative at any time. This value is: 


7) No PO elements can be speculative at any time. 

















The TRCIDR8 can be accessed through the external debug interface, offset 0x180. 


12.8.23 ID Register 9 
The TRCIDR9 characteristics are: 


Purpose Returns the number of PO right-hand keys that the trace unit can use. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDR9 bit assignments. 


31 0 


NUMPOKEY 


Figure 12-25 TRCIDR9Y bit assignments 
The following table shows the TRCIDR9 bit assignments. 


Table 12-26 TRCIDR9 bit assignments 





Bits |Name Function 





[31:0] | NUMPOKEY | Indicates the number of PO right-hand keys that the trace unit can use. This value is: 


(2 The trace unit cannot use any PO right-hand keys. 

















The TRCIDR9 can be accessed through the external debug interface, offset 0x184. 


12.8.24 ID Register 10 
The TRCIDR10 characteristics are: 


Purpose Returns the number of P1 right-hand keys that the trace unit can use. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDR10 bit assignments. 
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NUMP1KEY 


Figure 12-26 TRCIDR10 bit assignments 
The following table shows the TRCIDR10 bit assignments. 
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Table 12-27 TRCIDR10 bit assignments 





Bits |Name Function 





[31:0] | NUMP1KEY | Indicates the number of P1 right-hand keys that the trace unit can use. This value is: 


7) The trace unit cannot use any P1 right-hand keys. 














The TRCIDR1O0 can be accessed through the external debug interface, offset 0x188. 


12.8.25 ID Register 11 
The TRCIDR11 characteristics are: 


Purpose Returns the number of special P1 right-hand keys that the trace unit can use. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDR11 bit assignments. 
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Figure 12-27 TRCIDR11 bit assignments 
The following table shows the TRCIDR11 bit assignments. 


Table 12-28 TRCIDR11 bit assignments 





Bits |Name Function 





[31:0] | NUMP1SPC | Indicates the number of special P1 right-hand keys that the trace unit can use. This value is: 


e The trace unit cannot use any special P1 right-hand keys. 

















The TRCIDR11 can be accessed through the external debug interface, offset @x18C. 


12.8.26 ID Register 12 
The TRCIDR12 characteristics are: 


Purpose Returns the number of conditional instruction right-hand keys that the trace unit can 
use. 

Usage constraints There are no usage constraints. 

Configurations Available in all configurations. 

Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDR12 bit assignments. 
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NUMCONDKEY 


Figure 12-28 TRCIDR12 bit assignments 
The following table shows the TRCIDR12 bit assignments. 
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Table 12-29 TRCIDR12 bit assignments 





Bits 


Name 


Function 





[31:0] 





NUMCONDKEY 





Indicates the number of conditional instruction right-hand keys that the trace unit can use. The number 
includes normal and special keys. This value is: 


(2) The trace unit cannot use any conditional instruction right-hand keys. 








12.8.27 


The TRCIDR12 can be accessed through the external debug interface, offset 0x199. 


ID Register 13 


The TRCIDR13 characteristics are: 


Purpose Returns the number of special conditional instruction right-hand keys that the trace 


unit can use. 


Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 
Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 


on page 12-472. 


The following figure shows the TRCIDR13 bit assignments. 


31 0 


NUMCONDSPC 


Figure 12-29 TRCIDR13 bit assignments 


The following table shows the TRCIDR13 bit assignments. 


Table 12-30 TRCIDR13 bit assignments 





Bits 


Name 


Function 





[31:0] 








NUMCONDSPC 





Indicates the number of special conditional instruction right-hand keys that the trace unit can use. 


(2 The trace unit cannot use any special conditional instruction right-hand keys. 








12.8.28 


The TRCIDR13 can be accessed through the external debug interface, offset 0x194. 


Implementation Specific Register 0 


The TRCIMSPECO characteristics are: 


Purpose Shows the presence of any implementation specific features, and enables any 


features that are provided. 


Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 


on page 12-472. 


The following figure shows the TRCIMSPECO bit assignments. 
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Figure 12-30 TRCIMSPECO bit assignments 
The following table shows the TRCIMSPECO bit assignments. 


Table 12-31 TRCIMSPECO bit assignments 











Bits | Name Function 
[31:4] | - Reserved, RESO. 
[3:0] | SUPPORT | 9 No implementation specific extensions are supported. 














The TRCIMSPEC0 register can be accessed through the external debug interface, offset @x1C@. 


12.8.29 ID Register 0 
The TRCIDRO characteristics are: 
Purpose Returns the tracing capabilities of the ETM trace unit. 
Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDRO bit assignments. 


31 30 29 28 24 23 17161514131211109 8 7 65 43 21 0 
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QFILT INSTPO 
CONDTYPE TRCDATA 
NUMEVENT TRCBB 
RETSTACK TRCCOND 
RESO TRCCCI 





Figure 12-31 TRCIDRO bit assignments 
The following table shows the TRCIDRO bit assignments. 


Table 12-32 TRCIDRO bit assignments 





Bits Name Function 





[31:30] | - Reserved, RESO. 





[29] COMMOPT | Commit mode field. This value is: 


1 Commit mode 1. 


See the ARM® ETM Architecture Specification, ETMv4 for more information on how this affects certain 
packets. 
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Table 12-32 TRCIDRO bit assignments (continued) 





Bits 


Name 


Function 





[28:24] 


TSSIZE 


Global timestamp size. This value is: 


0b01000 Implementation supports a maximum global timestamp of 64 bits. 





[23:17] 


Reserved, RESO. 





[16:15] 


QSUPP 


Indicates Q element support. This value is: 


@bee Q element support is not implemented. TRCCONFIGR.QE is RESO. 





[14] 


QFILT 


QFILT is RESO when QSUPP==0x00. 





[13:12] 


CONDTYPE 


Conditional tracing field. This value is: 


@bee The ETM trace unit indicates only if a conditional instruction passes or fails its condition code 
check. 





[11:10] 


NUMEVENT 


Number of events supported in the trace, minus 1. This value is: 


@b11 The ETM trace unit supports four events. 


This field controls how many fields are supported in TRCEVENTCTLOR and indicates the size of 
TRCEVENTCTRLIR.INSTEN. 





[9] 


RETSTACK 


Return stack support. This value is: 


1 Return stack is implemented, so TRCCONFIGR.RS is supported. 





[8] 


Reserved, RESO. 





[7] 


TRCCCI 


Cycle counting instruction bit. Indicates whether the trace unit supports cycle counting for instructions. This 
value is: 


1 Cycle counting in the instruction trace is implemented, therefore: 


e TRCCONFIGR.CCI is supported. 
e TRCCCCTLR is supported. 





[6] 


TRCCOND 


Conditional instruction tracing support bit. This value is: 


(2 Conditional instruction tracing is not supported. 





TRCBB 


Branch broadcasting tracing support bit. Indicates whether the trace unit supports branch broadcast tracing. 
This value is: 


1 Branch broadcast tracing is supported, therefore: 


e TRCCONFIGR.BB is supported. 
e TRCBBCTLR is supported. 





[4:3] 


TRCDATA 


Conditional tracing field. This value is: 


@bee Data tracing is not supported. 





[2:1] 


INSTPO 


PO tracing support field. Indicates support for tracing of load and store instructions as PO elements. This value 
is: 


@bee Tracing of load and store instructions as PO elements is not supported. 





[0] 











Reserved, RES1. 








The TRCIDRO can be accessed through the external debug interface with offset @x1E@. 





ARM 100048_0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 12-501 


reserved. 
Non-Confidential 


12 Embedded Trace Macrocell 
12.8 ETM register descriptions 



































12.8.30 ID Register 1 
The TRCIDRI characteristics are: 
Purpose Returns the base architecture of the trace unit. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 
Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCIDR1 bit assignments. 
31 24 23 16 15 12 11 8 7 4 3 0 
| oae | ren e o e 
TRCARCHMAJ — 
TRCARCHMIN 
Figure 12-32 TRCIDR1 bit assignments 
The following table shows the TRCIDR1 bit assignments. 
Table 12-33 TRCIDR1 bit assignments 
Bits |Name Function 
[31:24] | DESIGNER Indicates which company designed the trace unit. This value is: 
0x41 ARM Limited. 
[23:16] | - Reserved, RESO. 
[15:12] | - Reserved, RES1. 
[11:8] | TRCARCHMAJ | Indicates the major version number of the trace unit architecture. This value is: 
0b0100  ETMv4. 
[7:4] | TRCARCHMIN | Indicates the minor version number of the trace unit architecture. This value is: 
@beeee@ = ETMv4 minor revision 0. 
[3:0] | REVISION Indicates the revision numbers of the trace registers and the OS Lock registers. This value is: 
@beeee = r0p0. 
The TRCIDRI can be accessed through the external debug interface, offset @x1E4. 
12.8.31 ID Register 2 


The TRCIDR2 characteristics are: 


Purpose Returns the maximum size of the following parameters in the trace unit: 


e Cycle counter. 

e Data value. 

¢ Data address. 

* VMID. 

e Context ID. 

¢ Instruction address. 


Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 
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Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 


on page 12-472. 


The following figure shows the TRCIDR2 bit assignments. 
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Figure 12-33 TRCIDR2 bit assignments 


The following table shows the TRCIDR2 bit assignments. 


Table 12-34 TRCIDR2 bit assignments 





Bits 


Name 


Function 





[31:29] 


Reserved, RESO. 





[28:25] 


CCSIZE 


Indicates the size of the cycle counter in bits minus 12. This value is: 


0x0 The cycle counter is 12 bits in length. 





[24:20] 


DVSIZE 


Indicates the data value size in bytes. This value is: 


0x0 Data value tracing is not supported, as indicated by TRCIDRO.TRCDATA. 





[19:15] 





DASIZE 


Indicates the data address size in bytes. This value is: 


@x® Data address tracing is not supported, as indicated by TRCIDRO.TRCDATA. 





[14:10] 





VMIDSIZE 


Indicates the Virtual Machine ID size. This value is: 
@x1 Maximum of 8-bit VMID size, therefore TRCCONFIGR.VMID is supported. 





[9:5] 


CIDSIZE 


Indicates the Context ID size in bytes. This value is: 


0x4 Maximum of 32-bit Context ID size, therefore TRCCONFIGR.CID is supported. 





[4:0] 








IASIZE 





Indicates the instruction address size in bytes. This value is: 


0x8 Maximum of 64-bit address size. 








12.8.32 


The TRCIDR2 can be accessed through the external debug interface with offset 0x1E8. 


ID Register 3 
The TRCIDR3 characteristics are: 


Purpose Indicates: 


e Whether TRCVICTLR.TRCERR is supported. 

¢ The number of cores available for tracing. 

e Whether an Exception level supports instruction tracing. 

¢ The minimum threshold value for instruction trace cycle counting. 

¢ Whether the synchronization period is fixed. 

e Whether TRCSTALLCTLR is supported and if so whether it supports trace 
overflow prevention and supports stall control of the processor. 


Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 
Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 


on page 12-472. 
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The following figure shows the TRCIDR3 bit assignments. 
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Figure 12-34 TRCIDR3 bit assignments 


The following table shows the TRCIDR3 bit assignments. 


Table 12-35 TRCIDR3 bit assignments 



































Bits |Name Function 
[31] NOOVERFLOW | Indicates whether TRCSTALLCTLR.NOOVERFLOW is implemented. This value is: 
2) TRCSTALLCTLR.NOOVERFLOW is not implemented. 
[30:28] | NUMPROC Indicates the number of cores available for tracing, minus one. This value is: 
ebeee The trace unit can trace one core. ETM trace unit sharing is not supported. 
[27] SYSSTALL Indicates whether stall control is implemented. This value is: 
1 The system supports core stall control. 
[26] STALLCTL Indicates whether TRCSTALLCTLR is implemented. This value is: 
1 TRCSTALLCTLR is implemented. 
This field is used in conjunction with SYSSTALL. 
[25] SYNCPR Indicates whether there is a fixed synchronization period. This value is: 
2) TRCSYNCPR is read-write so software can change the synchronization period. 
[24] TRCERR Indicates whether TRCVICTLR.TRCERR is supported. This value is: 
1 TRCVICTLR.TRCERR is supported. 
[23:20] | EXLEVEL NS |In Non-secure state, each bit indicates whether instruction tracing is supported for the corresponding 
Exception level. This value is: 
@b@111 Instruction tracing is supported for Non-secure ELO, EL1, and EL2 Exception levels. 
[19:16] | EXLEVEL S In Secure state, each bit indicates whether instruction tracing is supported for the corresponding Exception 





level. This value is: 


@b1011 Instruction tracing is supported for Secure ELO, EL1, and EL3 exception levels. 
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Table 12-35 TRCIDR3 bit assignments (continued) 















































Bits |Name Function 
[15:12] | - Reserved, RESO. 
[11:0] | CCITMIN Indicates the minimum value that can be programmed in TRCCCCTLR.THRESHOLD. This value is: 
0x004 The minimum instruction trace cycle counting threshold is 4. 
The TRCIDR3 can be accessed through the external debug interface, offset @x1EC. 
12.8.33 ID Register 4 
The TRCIDR4 characteristics are: 
Purpose Returns how many resources the trace unit supports. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 
Attributes A 32-bit RO register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCIDR4 bit assignments. 
28 27 24 23 20 19 16 15 12 11 98 7 
NUMVMIDC} NUMCIDC | NUMSSCC i NUMPC reo | | NUMDVC T] 
NUMRCPAIR — SUPPDAC- NUMACPAIRS —! 
Figure 12-35 TRCIDR4 bit assignments 
The following table shows the TRCIDR4 bit assignments. 
Table 12-36 TRCIDR4 bit assignments 
Bits |Name Function 
[31:28] | NUMVMIDC _| Indicates the number of VMID comparators that are available for tracing. This value is: 
@b@e01 One VMID comparator is available. 
[27:24] | NUMCIDC Indicates the number of Context ID comparators that are available for tracing. This value is: 
@b@001 One Context ID comparator is available. 
[23:20] | NUMSSCC Indicates the number of single-shot comparator controls that are available for tracing. This value is: 
@b@@01 One single-shot comparator control is available. 
[19:16] | NUMRSPAIR | Indicates the number of resource selection pairs that are available for tracing, minus 1. This value is: 
@b@111 Eight resource selection pairs are available. 
[15:12] | NUMPC Indicates the number of processor comparator inputs that are available for tracing. This value is: 
@be@ee@ No processor comparator inputs are available. 
[11:9] |- Reserved, RESO. 




















ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 
reserved. 
Non-Confidential 


12-505 


12 Embedded Trace Macrocell 
12.8 ETM register descriptions 


Table 12-36 TRCIDR4 bit assignments (continued) 











Bits |Name Function 
[8] SUPPDAC Indicates data address comparison support. This value is: 
7) Data address comparisons are not supported. 
[7:4] | NUMDVC Indicates the number of data value comparators that are available for tracing. This value is: 


@be@ee08 No data value comparators are available. 





[3:0] | NUMACPAIRS | Indicates the number of address comparator pairs that are available for tracing. This value is: 


@b@10@ Four address comparator pairs are available. 

















The TRCIDR4 can be accessed through the external debug interface with offset @x1F@. 


12.8.34 ID Register 5 
The TRCIDRS characteristics are: 
Purpose Returns how many resources the trace unit supports. 
Usage constraints There are no usage constraints. 


Configurations Available in all configurations. 


Attributes A 32-bit RO trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCIDRS bit assignments. 
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Figure 12-36 TRCIDRS5 bit assignments 
The following table shows the TRCIDRS bit assignments. 


Table 12-37 TRCIDRS5 bit assignments 





Bits Name Function 





[31] REDFUNCNTR | Indicates whether the reduced function counter is supported. This value is: 


e The reduced function counter is not supported. 





[30:28] | NUMCNTR Indicates the number of counters that are available for tracing. This value is: 


@be@10 Two counters are available. 





[27:25] | NUMSEQSTATE | Indicates the number of sequencer states that are implemented. This value is: 


@b10@ Four sequencer states are implemented. 





[24] Reserved, RESO. 
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Table 12-37 TRCIDRS5 bit assignments (continued) 









































Bits |Name Function 
[23] LPOVERRIDE _ | Indicates whether low power state override is supported. This value is: 
1 Low power state override support is supported. 
[22] ATBTRIG Indicates whether ATB triggers are supported. This value is: 
1 ATB triggers are supported and TRCEVENTCTLIR.ATB is implemented. 
[21:16] | TRACEIDSIZE | Indicates trace ID width. This value is: 
0x07 A 7-bit trace ID is supported. This defines the width of the TRCTRACEIDR.TRACEID field. 
Note 
The CoreSight ATB requires a 7-bit trace ID width. 
[15:12] | - Reserved, RESO. 
[11:9] | NUMEXTINSEL | Indicates the number of external input selectors that are implemented. This value is: 
@b10@ Four external input selectors are implemented. 
[8:0] | NUMEXTIN Indicates the number of external inputs that are implemented. This value is: 
0b000011110 30 external inputs implemented. 
The TRCIDRS can be accessed through the external debug interface with offset @x1F4. 
12.8.35 | Resource Selection Control Registers 2-16 


The TRCRSCTLRn characteristics are: 


Purpose 


Usage 


constraints ° 


Configurations 


Attributes 


Controls the trace resources. 


There are eight resource pairs, the first pair is predefined as {0,1,pair=0} and 
reserves select registers. This leaves seven pairs to be implemented as programmable 
selectors. 


e This register accepts writes only when the trace unit is disabled. 

If software selects a non-implemented resource then CONSTRAINED UNPREDICTABLE 
behavior of the resource selector occurs. The resource selector might activate 
unexpectedly or might not activate. Reads of the TRCRSCTLRn might return 
UNKNOWN. 


Resource selectors are implemented in pairs and there are eight pairs of 
TRCRSCTLR registers implemented, set by TRCIDR4.NUMRSPAIR. Each odd 
numbered resource selector is part of a pair with the even numbered resource selector 
that is numbered as one less than it. For example, resource selectors 2 and 3 form a 
pair. 


Resource selector pair 0 is always implemented and is reserved. Resource selector 
zero always returns FALSE, and resource selector one always returns TRUE. 


A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCRSCTLRn bit assignments. 
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31 2221201918 1615 8 7 0 


PAIRINV — L RESO 
INV 


Figure 12-37 TRCRSCTLRn bit assignments 


The following table shows the TRCRSCTLRn bit assignments. 


Table 12-38 TRCRSCTLRn bit assignments 












































Bits |Name Function 
[31:22] | - Reserved, RESO. 
[21] PAIRINV | Controls whether the combined result from a resource pair is inverted when n is even. The possible values are: 
(2) The combined result is not inverted. 
1 The combined result is inverted. 
PAIRINV is RESO when n is odd. 
[20] INV Controls whether the resource that GROUP and SELECT selects is inverted. The possible values are: 
(3 The selected resource is not inverted. 
1 The selected resource is inverted. 
[19] - Reserved, RESO. 
[18:16] | GROUP | Selects a group of resources. See the ARM® ETM Architecture Specification, ETMv4 for more information. 
[15:8] |- Reserved, RESO. 
[7:0] SELECT | Selects one or more resources from the group that the GROUP field selects. Each bit represents a resource from 
the selected group. See the ARM® ETM Architecture Specification, ETMv4 for more information. 
The TRCRSCTLRn can be accessed through the external debug interface, offset @x208-023C. 
12.8.36 | Single-Shot Comparator Control Register 0 
The TRCSSCCRO characteristics are: 
Purpose Controls the single-shot comparator resource. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCSSCCR0O bit assignments. 
31 25 24 23 20 19 16 15 8 7 0 
= ff=t=f = T= 
RST— 
Figure 12-38 TRCSSCCRO bit assignments 
The following table shows the TRCSSCCRO bit assignments. 
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Table 12-39 TRCSSCCR0O bit assignments 





Bits Name | Function 











[31:25] | - Reserved, RESO. 
[24] RST | Controls whether the single-shot comparator resource is reset when it fires. The possible values are: 
e The single-shot comparator resource is not reset when it fires. 
1 The single-shot comparator resource is reset when it fires. This enables the single-shot comparator 
resource to fire multiple times. 
[23:20] | - Reserved, RESO. 





[19:16] | ARC | Selects one or more address range comparators for single-shot control. One bit is provided for each implemented 
address range comparator. 





[15:8] Reserved, RESO. 





[7:0] SAC | Selects one or more single address comparators for single-shot control. One bit is provided for each implemented 
single address comparator. 














The TRCSSCCRO can be accessed through the external debug interface, offset 0x280. 


12.8.37 | Single-Shot Comparator Status Register 0 
The TRCSSCSRO characteristics are: 


Purpose Indicates the status of the single-shot comparator: 
e TRCSSCSR0 is sensitive to instruction addresses. 


Usage constraints * Accepts writes only when the trace unit is disabled. 
e The STATUS bit value is stable only when TRCSTATR.PMSTABLE == 1. 


Configurations Available in all configurations. 


Attributes A 32-bit register, some fields are RW and others are RO. See also Table 12-3 ETM 
trace unit register summary on page 12-472. 


The following figure shows the TRCSSCSRO bit assignments. 


31 30 3.2 1 0 


L— STATUS DV— 
DA 
INST 


Figure 12-39 TRCSSCSRO bit assignments 
The following table shows the TRCSSCSRO bit assignments. 
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Table 12-40 TRCSSCSR0O bit assignments 









































Bits |Name_ | Function 
[31] | STATUS | Single-shot status. This indicates whether any of the selected comparators, that TRCSSCCRO.SAC or 
TRCSSCCRO.ARC selects, have matched: 
(2 No match has occurred. 
When the first match occurs, this field takes a value of @b1. It remains at @b1 until explicitly modified 
by a write to this register. 
1 One or more matches has occurred. If TRCSSCCRn.RST == @ then: 
¢ There is only one match and no more matches are possible. 
e You must reset this bit to @ to re-enable single-shot control. 
[30:3] | - Reserved, RESO. 
[2] DV Indicates if the trace unit supports data address with data value comparisons. This field is read-only. This value is: 
(2) Single-shot data address with data value comparisons are not supported. 
[1] DA Indicates if the trace unit supports data address comparisons. This field is read-only. This value is: 
(2 Single-shot data address comparisons are not supported. 
[0] INST Indicates if the trace unit supports instruction address comparisons. This field is read-only. This value is: 
1 Single-shot instruction address comparisons are supported. 
The TRCSSCSRO can be accessed through the external debug interface, offset @x2A@. 
12.8.38 | Address Comparator Value Registers 0-7 
The TRCACVRn characteristics are: 
Purpose Indicates the address for the address comparators. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 
Attributes A 64-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCACVRn bit assignments. 
63 0 
ADDRESS 
Figure 12-40 TRCACVRn bit assignments 
The following table shows the TRCACVRn bit assignments. 
Table 12-41 TRCACVRn bit assignments 
Bits | Name Function 
[63:0] | ADDRESS | The address value to compare against. See the ARM® ETM Architecture Specification, ETMv4 for more 
information. 

















The TRCACVRn can be accessed through the external debug interface, offset @x4@0-0x43C. 
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12.8.39 | Address Comparator Access Type Registers 0-7 

The TRCACATRn characteristics are: 

Purpose Defines the type of access for the corresponding TRCACVRn. This register 
configures the context type, Exception levels, alignment and masking that is applied 
by the address comparator, together with how the address comparator behaves when 
it is one half of an address range comparator. 

Usage e This register accepts writes only when the trace unit is disabled. 

constraints e Ifsoftware uses two single address comparators as an address range comparator 

then it must program the corresponding TRCACATR registers with identical 
values in the following fields: 

— TYPE 

— CONTEXTTYPE 

— EXLEVEL S 

— EXLEVEL_NS 

Configurations Available in all configurations. 

Attributes A 64-bit RW trace register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 

The following figure shows the TRCACATRn bit assignments. 

63 16:15 12:11 8 7 43210 
EXLEVEL_NS— CONTEXTTYPE— 
e o 
Figure 12-41 TRCACATRn bit assignments 

The following table shows the TRCACATRn bit assignments. 

Table 12-42 TRCACATRnh bit assignments 
Bits |Name Function 
[63:16] | - Reserved, RESO. 
[15:12] | EXLEVEL NS _ | Each bit controls whether a comparison can occur in Non-secure state for the corresponding Exception 











level. The possible values are: 


Q 
1 


The trace unit can perform a comparison, in Non-secure state, for Exception level n. 


The trace unit does not perform a comparison, in Non-secure state, for Exception level n. 





The exception levels are: 


Note 











Bit[12] Exception level 0. 
Bit[13] Exception level 1. 
Bit[14] Exception level 2. 
Bit[15] Always RESO. 
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Table 12-42 TRCACATRh bit assignments (continued) 





Bits 


Name 


Function 





[11:8] 


EXLEVEL S 


Each bit controls whether a comparison can occur in Secure state for the corresponding Exception level. 
The possible values are: 


7) The trace unit can perform a comparison, in Secure state, for Exception level n. 


1 The trace unit does not perform a comparison, in Secure state, for Exception level n. 





Note 
The Exception levels are: 
Bit[8] Exception level 0. 
Bit[9] Exception level 1. 
Bit[10] Always RESO. 
Bit[11] Exception level 3. 








[7:4] 


Reserved, RESO. 





[3:2] 


CONTEXTTYPE 


Controls whether the trace unit performs a Context ID comparison, a VMID comparison, or both 
comparisons. The possible values are: 


@be@e The trace unit does not perform a Context ID comparison. 

@b@1 The trace unit performs a Context ID comparison using the Context ID comparator that the 
CONTEXT field specifies, and signals a match if both the Context ID comparator matches and 
the address comparator match. 

@b1@ The trace unit performs a VMID comparison using the VMID comparator that the CONTEXT 
field specifies, and signals a match if both the VMID comparator and the address comparator 
match. 

@b11 The trace unit performs a Context ID comparison and a VMID comparison using the 
comparators that the CONTEXT field specifies, and signals a match if the Context ID 
comparator matches, the VMID comparator matches, and the address comparator matches. 





[1:0] 








TYPE 





Controls what type of comparison the trace unit performs. This value is: 


@bee Instruction address, RESO. 








12.8.40 


The TRCACATR=a can be accessed through the external debug interface, offset 0x480-0x4B8. 


Context ID Comparator Value Register 0 
The TRCCIDCVRO characteristics are: 


Purpose 


Contains a Context ID value. 


Usage constraints This register accepts writes only when the trace unit is disabled. 


Configurations Available in all configurations. 


Attributes A 64-bit RW trace register. See also Table 12-3 ETM trace unit register summary 


on page 12-472. 


The following figure shows the TRCCIDCVR0O bit assignments. 





ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 12-512 
reserved. 
Non-Confidential 


12 Embedded Trace Macrocell 
12.8 ETM register descriptions 


63 32 31 0 


RESO VALUE 


Figure 12-42 TRCCIDCVRO bit assignments 
The following table shows the TRCCIDCVR0O bit assignments. 


Table 12-43 TRCCIDCVR0O bit assignments 





Bits Name | Function 





[63:32] | - Reserved, RESO. 





[31:0] | VALUE | Context ID value. 

















The TRCCIDCVRO can be accessed through the external debug interface, offset 0x600. 


VMID Comparator Value Register 0 
The TRCVMIDCVRO characteristics are: 


Purpose Contains a VMID value. 
Usage constraints This register accepts writes only when the trace unit is disabled. 
Configurations Available in all configurations. 


Attributes A 64-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCVMIDCVR0O bit assignments. 
63 8 7 0 


RESO VALUE 


Figure 12-43 TRCVMIDCVRO bit assignments 
The following table shows the TRCVMIDCVR0O bit assignments. 


Table 12-44 TRCVMIDCVRO bit assignments 





Bits | Name | Function 





[63:8] | - Reserved, RESO 

















[7:0] | VALUE | The VMID value. 





The TRCVMIDCVRO can be accessed through the external debug interface, offset 0x640. 


Context ID Comparator Control Register 0 


The TRCCIDCCTLRO characteristics are: 


Purpose Contains Context ID mask values for TRCCIDCVRO. 


Usage constraints * This register accepts writes only when the trace unit is disabled. 
e Ifsoftware uses TRCCIDCVRQO, then it must program this register. 
e Ifsoftware sets a mask bit to 1 then it must program the relevant byte in 
TRCCIDCVRO to 0x00. 


Configurations Available in all configurations. 
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Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCIDCCTLR0O bit assignments. 
31 4 3 0 


Figure 12-44 TRCCIDCCTLRO bit assignments 
The following table shows the TRCCIDCCTLRO bit assignments. 


Table 12-45 TRCCIDCCTLRO bit assignments 





Bits |Name | Function 





[31:4] | - Reserved, RESO. 





[3:0] | COMPO | Controls the mask value that the trace unit applies to TRCCIDCVRO. Each bit in this field corresponds to a byte in 
TRCCIDCVRO. When a bit is: 


7) The trace unit includes the relevant byte in TRCCIDCVRO when it performs the Context ID comparison. 
1 The trace unit ignores the relevant byte in TRCCIDCVRO when it performs the Context ID comparison. 














The TRCCIDCCTLRO can be accessed through the external debug interface, offset 0x680. 


12.8.43 Integration ATB Identification Register 
The TRCITATBIDR characteristics are: 


Purpose Sets the state of output pins. 


Usage constraints * Available when bit[0] of TRCITCTRL is set to 1. 
¢ The value of the register sets the signals on the output pins when the register is 
written. 


Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCITATBIDR bit assignments. 
31 7 6 0 


ee 


Figure 12-45 TRCITATBIDR bit assignments 
The following table shows the TRCITATBIDR bit assignments. 


Table 12-46 TRCITATBIDR bit assignments 





Bits | Name | Function 





[31:7] | - Reserved. Read undefined. 





[6:0] |ID Drives the ATIDMn[6:0] output pins". 

















The TRCITATBIDR can be accessed through the external debug interface, offset @xEE4. 





dk — When a bit is set to @, the corresponding output pin is LOW. When a bit is set to 1, the corresponding output pin is HIGH. The TRCITATBIDR bit values 
correspond to the physical state of the output pins. 
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12.8.44 Integration Instruction ATB Data Register 
The TRCITIDATAR characteristics are: 


Purpose Sets the state of the ATDATAMn output pins. 


Usage constraints * Available when bit[0] of TRCITCTRL is set to 1. 
¢ The value of the register sets the signals on the output pins when the register is 
written. 


Configurations Available in all configurations. 
Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 
The following figure shows the TRCITIDATAR bit assignments. 
31 5 4 


3 
RESO ii 


ATDATAM[31] el 
ATDATAM[23] 


ATDATAM[15] 
ATDATAMI7] 
ATDATAM[O] 





Figure 12-46 TRCITIDATAR bit assignments 
The following table shows the TRCITIDATAR bit assignments. 


Table 12-47 TRCITIDATAR bit assignments 





Bits | Name Function 





[31:5] |- Reserved, RESO 





[4] | ATDATAM[31] | Drives the ATDATAM[31] output“! 





[3] | ATDATAM[23] | Drives the ATDATAM[23] output“! 





[2] | ATDATAM[I5] | Drives the ATDATAM[L5] output“! 





[1] | ATDATAM[7] | Drives the ATDATAM[7] output“! 














[0] ATDATAM[0] | Drives the ATDATAM[0] output“! 

















The TRCITIDATAR can be accessed through the external debug interface, offset @xEEC. 





dl When a bit is set to Q, the corresponding output pin is LOW. When a bit is set to 1, the corresponding output pin is HIGH. The TRCITIDATAR bit values correspond 
to the physical state of the output pins. 
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Integration Instruction ATB In Register 


The TRCITIATBINR characteristics are: 


Purpose Reads the state of the input pins. 


Usage constraints * Available when bit[0] of TRCITCTRL is set to 1. 
¢ The values of the register bits depend on the signals on the input pins when the 
register is read. 


Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCITIATBINR bit assignments. 
31 210 


emt LY 
AFVALIDM 
ATREADYM 

Figure 12-47 TRCITIATBINR bit assignments 


The following table shows the TRCITIATBINR bit assignments. 


Table 12-48 TRCITIATBINR bit assignments 





Bits |Name Function 





[31:2] | - Reserved. Read undefined. 





[1] AFVALIDM | Returns the value of the AFVALIDMn input pin”. 

















[0] ATREADYM | Returns the value of the ATREADYMn input pin®”. 





The TRCITIATBINR can be accessed through the external debug interface, offset @xEF4. 





dm 


When an input pin is LOW, the corresponding register bit is @. When an input pin is HIGH, the corresponding register bit is 1. The TRCITIATBINR bit values 
always correspond to the physical state of the input pins. 
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Integration Instruction ATB Out Register 


The TRCITIATBOUTR characteristics are: 


Purpose Sets the state of the output pins. 


Usage constraints * Available when bit[0] of TRCITCTRL is set to 1. 
¢ The value of the register sets the signals on the output pins when the register is 
written. 


Configurations Available in all configurations. 


Attributes A 32-bit RW register. See also Zable 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCITIATBOUTR bit assignments. 
31 109 8 7 210 


BYTES AFREADY 
ATVALID 
Figure 12-48 TRCITIATBOUTR bit assignments 
The following table shows the TRCITIATBOUTR bit assignments. 


Table 12-49 TRCITIATBOUTR bit assignments 





Bits Name Function 





[31:10] | - Reserved. Read undefined. 





[9:8] BYTES Drives the ATBYTESMn[1:0] output pins“". 





[7:2] l- Reserved. Read undefined. 





[1] AFREADY | Drives the AFREADYMn output pin“. 

















[0] ATVALID | Drives the ATVALIDMn output pin®”. 





The TRCITIATBOUTR can be accessed through the external debug interface, offset @xEFC. 


Integration Mode Control Register 


The TRCITCTRL characteristics are: 


Purpose Controls whether the trace unit is in integration mode. 
Usage constraints * Accessible only from the memory-mapped interface or from an external agent 
such as a debugger. 
e ARM recommends that you perform a debug reset after using integration mode. 
Configurations Available in all configurations. 


Attributes A 32-bit management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 


The following figure shows the TRCITCTRL bit assignments. 





dn 


When a bit is set to O, the corresponding output pin is LOW. When a bit is set to 1, the corresponding output pin is HIGH. The TRCITIATBOUTR bit values always 
correspond to the physical state of the output pins. 
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31 1 0 
mY 
IME - 


Figure 12-49 TRCITCTRL bit assignments 
The following table shows the TRCITCTRL bit assignments. 


Table 12-50 TRCITCTRL bit assignments 





Bits | Name | Function 





[31:1] Reserved, RESO. 





[0] IME | Integration mode enable bit. The possible values are: 
(2 The trace unit is not in integration mode. 
1 The trace unit is in integration mode. This mode enables: 


« A debug agent to perform topology detection. 
e SoC test software to perform integration testing. 














The TRCITCTRL register can be accessed through the external debug interface, offset @xFee. 


12.8.48 Claim Tag Set Register 
The TRCCLAIMSET characteristics are: 


Purpose Sets bits in the claim tag to 1 and determines the number of bits that the claim tag 
supports. 


Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCLAIMSET bit assignments. 


Figure 12-50 TRCCLAIMSET bit assignments 
The following table shows the TRCCLAIMSET bit assignments. 


Table 12-51 TRCCLAIMSET bit assignments 





Bits | Name | Function 





Reserved, RESO. 


[31:4] 





[3:0] | SET | When a write to one of these bits occurs, with the value: 
7) The register ignores the write. 


1 If the bit is supported, then it is set to 1. 


When a read occurs, the supported bits in the SET field are RESO and therefore the value the register returns indicates 
how many SET bits are supported. 
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The TRCCLAIMSET can be accessed through the the external debug interface, offset @xFAQ. 


12.8.49 Claim Tag Clear Register 
The TRCCLAIMCLR characteristics are: 


Purpose Clears bits in the claim tag to @ and determines the current value of the claim tag. 
Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes A 32-bit RW trace register. See also Table 12-3 ETM trace unit register summary 
on page 12-472. 


The following figure shows the TRCCLAIMCLR bit assignments. 


Figure 12-51 TRCCLAIMCLR bit assignments 
The following table shows the TRCCLAIMCLR bit assignments. 


Table 12-52 TRCCLAIMCLR bit assignments 





Bits | Name | Function 





[31:4] Reserved, RESO. 





[3:0] |CLR_ | When a write to one of these bits occurs, with the value: 


(2 The register ignores the write. 


1 If the bit is supported, then it is set to . 





A read returns the value of the claim tag. 














The TRCCLAIMCLR can be accessed through the external debug interface, offset @xFA4. 


12.8.50 Device Affinity Register 0 
The TRCDEVAFFO characteristics are: 


Purpose TRCDEVAFFO returns the lower 32 bits of the processor MPIDR_ELI, that is, 
MPIDR_EL1[31:0]. This enables a debugger to determine which processor in a 
multiprocessor system the trace unit relates to. 


TRCDEVAFFO is a read-only copy of MPIDR_ELI accessible from the external 
debug interface. 








Usage This register is accessible as follows: 

constraints 
ELO | ELO/EL1 | EL1 | EL2 | EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - RO |RO [RO |RO RO 


























Configurations Available in all configurations. 


Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 


The following figure shows the TRCDEVAFFO0 bit assignments. 
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31 30 29 25 24 23 16 15 8 7 0 
MT— 


Figure 12-52 TRCDEVAFFO bit assignments 
The following table shows the TRCDEVAFFO bit assignments. 


Table 12-53 TRCDEVAFFO bit assignments 





Bits 


Name 


Function 





[31] 


RES1. Indicates support for the Multiprocessing Extensions. 





[30] 


Indicates a single core system, as distinct from core 0 in a cluster. This value is: 


e Core is part of a cluster. 





[29:25] 


Reserved, RESO. 





[24] 


MT 


Indicates whether the lowest level of affinity consists of logical cores that are implemented using a multi-threading 
type approach. This value is: 


e The performance of cores at the lowest affinity level is largely independent. 





[23:16] 


Aff2 


Affinity level 2. The least significant affinity level field. 
Indicates the value read in the CLUSTERIDAFF? configuration signal. 





[15:8] 


Affl 


Affinity level 1. The intermediate affinity level for this core in the cluster. 


Indicates the value read in the CLUSTERIDAFF1[7:0] signal. 





[7:0] 








Aff0 





Affinity level 0. The most significant affinity level field for this core in the cluster. 
Indicates the core number in the Cortex-A73 processor: 

0x0 Core is CPU0. 

@x1 Core is CPU1. 

0x2 Core is CPU2. 

0x3 Core is CPU3. 








12.8.51 


Device Affinity Register 1 


The TRCDEVAFF!1 characteristics are: 


Purpose Returns the upper 32 bits of MPIDR_EL1, that is, MPIDR_EL1[63:32]. This 
enables a debugger to determine which core in a multiprocessor system the trace 
unit relates to. 


Usage constraints Accessible only from the external debugger interface. 

Configurations Available in all configurations. 

Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 


For the Cortex-A73 processor, MPIDR_EL1[63:32] is REso and so TRCDEVAFF! is 
RESO. 


The TRCDEVAFF1 can be accessed through the external debug interface, offset @xFAC. 
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12.8.52 Peripheral Identification Registers 


The Peripheral Identification Registers provide standard information required for all CoreSight 
components. They are a set of eight registers, listed in register number order in the following table. 


Table 12-54 Summary of the Peripheral ID Registers 





Register Value | Offset 





Peripheral ID4 | 0x04 | @xFD@ 





Peripheral ID5 | 0x00 | OxFD4 





Peripheral ID6 | 0x00 | OxFD8 





Peripheral ID7 | 0x00 | @xFDC 





Peripheral IDO | 0x59 | OxFE@ 





Peripheral ID1 | @xB9 | @xFE4 





Peripheral ID2 | @x@B | O@xFE8 

















Peripheral ID3 | 0x00 | @xFEC 





Only bits[7:0] of each Peripheral ID Register are used, with bits[3 1:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 

The Peripheral ID registers are: 

e Peripheral Identification Register 0 on page 12-521. 

e Peripheral Identification Register 1 on page 12-522. 

e Peripheral Identification Register 2 on page 12-522. 

e Peripheral Identification Register 3 on page 12-523. 

e Peripheral Identification Register 4 on page 12-524. 

e Peripheral Identification Register 5-7 on page 12-524. 


Peripheral Identification Register 0 
The TRCPIDRO characteristics are: 


Purpose Returns information that helps identify the peripheral. If software reads the 
TRCPIDR[7:0] register group then it can determine the 64-bit CoreSight Peripheral 
ID for the trace unit. 


Usage constraints * Only bits[7:0] are valid. 
e Accessible only from the external debugger interface, offset @xFEO. 


Configurations Available in all configurations. 


Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 


The following figure shows the TRCPIDR0O bit assignments. 


31 8 7 0 


Figure 12-53 TRCPIDRO bit assignments 
The following table shows the TRCPIDRO bit assignments. 
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Table 12-55 TRCPIDRO bit assignments 





















































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:0] | Part_0 | @x59 Least significant byte of the ETM trace unit part number. 
Peripheral Identification Register 1 
The TRCPIDRI characteristics are: 
Purpose Returns information that helps identify the peripheral. If software reads the 
TRCPIDR[7:0] register group then it can determine the 64-bit CoreSight Peripheral 
ID for the trace unit. 
Usage constraints * Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger 
interface. 
Configurations Available in all configurations. 
Attributes A 32-bit RO management register. See also Zable 12-3 ETM trace unit register 
summary on page 12-472. 
The following figure shows the TRCPIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 12-54 TRCPIDR1 bit assignments 
The following table shows the TRCPIDR1 bit assignments. 
Table 12-56 TRCPIDR1 bit assignments 
Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | DES 0] exp ARM Limited. This is bits[3:0] of JEP106 ID code. 
[3:0] | Part_! | @x9 Most significant four bits of the ETM trace unit part number. 
The TRCPIDRI can be accessed through the external debug interface, offset @xFE4. 
Peripheral Identification Register 2 
The TRCPIDR2 characteristics are: 
Purpose Returns information that helps identify the peripheral. If software reads the 
TRCPIDR[7:0] register group then it can determine the 64-bit CoreSight Peripheral 
ID for the trace unit. 
Usage constraints * Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger 
interface. 
Configurations Available in all configurations. 
Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 
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The following figure shows the TRCPIDR2 bit assignments. 


31 8.7 432 0 
JEDEC — 


Figure 12-55 TRCPIDR2 bit assignments 
The following table shows the TRCPIDR2 bit assignments. 


Table 12-57 TRCPIDR2 bit assignments 



























































Bits | Name |Function 
[31:8] | - Reserved, RESO. 
[7:4] | Revision | gx@ r0p0. 
[3] JEDEC | @b1 RES1. Indicates a JEP106 identity code is used. 
[2:0] |DES_1 |@be11 ARM Limited. This is bits[6:4] of JEP106 ID code. 
The TRCPIDR2 can be accessed through the external debug interface, offset @xFE8. 
Peripheral Identification Register 3 
The TRCPIDR3 characteristics are: 
Purpose Returns information that helps identify the peripheral. If software reads the 
TRCPIDR[7:0] register group then it can determine the 64-bit CoreSight Peripheral 
ID for the trace unit. 
Usage constraints * Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger 
interface. 
Configurations Available in all configurations. 
Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 
The following figure shows the TRCPIDR3 bit assignments. 
31 8 7 4 3 0 
Figure 12-56 TRCPIDR3 bit assignments 
The following table shows the TRCPIDR3 bit assignments. 
Table 12-58 TRCPIDR3 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | REVAND | 9@x@ Part minor revision. 
[3:0] | CMOD @x@ Not customer modified. 
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The TRCPIDR3 can be accessed through the external debug interface, offset @xFEC. 


Peripheral Identification Register 4 
The TRCPIDR4 characteristics are: 


Purpose Returns information that helps identify the peripheral. If software reads the 
TRCPIDR[7:0] register group then it can determine the 64-bit CoreSight Peripheral 
ID for the trace unit. 


Usage constraints * Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger 
interface. 


Configurations Available in all configurations. 


Attributes A 32-bit RO management register. See also Table 12-3 ETM trace unit register 
summary on page 12-472. 


The following figure shows the TRCPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 12-57 TRCPIDR4 bit assignments 
The following table shows the TRCPIDR4 bit assignments. 


Table 12-59 TRCPIDR4 bit assignments 





























Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | Size Ox@ This indicates that the trace unit memory map occupies 4KB. 
[3:0] | DES 2) Qx4 ARM Limited. This is bits[3:0] of the JEP106 continuation code. 
The TRCPIDR4 can be accessed through the external debug interface, offset @xFD@. 
Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6 and Peripheral ID7 Registers. They are 
reserved for future use and are RESO. 
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12.9 Interaction with Debug and Performance Monitoring Unit 
This section describes the interaction of the ETM with the PMU and Debug. 


This section contains the following subsections: 
e 12.9.1 Interaction with the Performance Monitoring Unit on page 12-525. 
e 12.9.2 Effect of Debug double lock on trace register access on page 12-525. 


12.9.1 Interaction with the Performance Monitoring Unit 


The Cortex-A73 processor includes a Performance Monitoring Unit (PMU) that enables events, such as 
cache misses and instructions executed, to be counted over a period of time. 


See Chapter 11 Performance Monitor Unit on page 11-425 for more information. 


Use of PMU events by the ETM trace unit 
All PMU architectural events are available to the ETM trace unit through the extended input facility. 


The ETM trace unit uses four extended external input selectors to access the PMU events. Each selector 
can independently select one of the PMU events, that are then active for the cycles where the relevant 
events occur. These selected events can then be accessed by any of the event registers within the ETM 
trace unit. 77.9 Events on page 11-457 describes the PMU events. See the ARM® Architecture Reference 
Manual ARMVv%, for ARMv8-A architecture profile for more information on PMU events. 


12.9.2 Effect of Debug double lock on trace register access 


All trace register accesses through the memory-mapped and external debug interfaces behave as if the 
processor power domain is powered down when Debug double lock is set. 


For more information on Debug double lock, see the ARM® Architecture Reference Manual ARMv8, for 
ARMV8-A architecture profile. 
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Chapter 13 
Cross Trigger 


This chapter describes the cross trigger interface for the Cortex-A73 processor. 


It contains the following sections: 

¢ 13.1 About the cross trigger on page 13-527. 

e 13.2 Trigger inputs and outputs on page 13-528. 

e 13.3 Cortex-A73 CTM on page 13-529. 

e 13.4 Cross trigger register summary on page 13-530. 

e 13.5 Cross trigger register descriptions on page 13-533. 
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13.1 About the cross trigger 


The Cortex-A73 processor has a single external cross trigger channel interface. This external interface is 
connected to the CoreSight Cross Trigger Interface (CTI) corresponding to each core through a Cross 
Trigger Matrix (CTM). A number of Embedded Cross Trigger (ECT) trigger inputs and trigger outputs 
are connected between debug components in the Cortex-A73 processor and CoreSight CTI blocks. 


The CTI enables the debug logic, ETM trace unit, and PMU to interact with each other and with other 
CoreSight components. This is called cross triggering. For example, you configure the CTI to generate 
an interrupt when the ETM trace unit trigger event occurs. 


The following figure shows the debug system components and the available trigger inputs and trigger 
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Figure 13-1 Debug system components 
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13 Cross Trigger 
13.2 Trigger inputs and outputs 


This section describes the trigger inputs and trigger outputs that are available to the CTI. 


The following table shows the CTI inputs. 


Table 13-1 Trigger inputs 







































































CTI input | Name Description 
0 DBGTRIGGER, pulsed | Pulsed on entry to Debug state 
1 PMUIRQ® PMU generated interrupt 
2 : z 
3 z 3 
4 EXTOUT[(0] ETM trace unit external output 
5 EXTOUT[1] ETM trace unit external output 
6 EXTOUT[2] ETM trace unit external output 
7 EXTOUT[3] ETM trace unit external output 
The following table shows the CTI outputs. 
Table 13-2 Trigger outputs 
CTI output | Name Description 
0 EDBGRQ Causes the processor to enter Debug state 
1 DBGRESTART | Causes the processor to exit Debug state 
2 CTIIRQ CTI interrupt 
3 2 - 
4 EXTIN[0] ETM trace unit external input 
5 EXTIN[1] ETM trace unit external input 
6 EXTIN[2] ETM trace unit external input 
T EXTIN[3] ETM trace unit external input 





do 

















This signal is the same as nPMUIRQ with inverted polarity. 
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13.3 Cortex-A73 CTM 


The CoreSight CTI channel signals from all the cores are combined using a Cross Trigger Matrix (CTM) 
block so that a single cross trigger channel interface is presented in the Cortex-A73 processor. This 
module can combine up to four internal channel interfaces corresponding to each core along with one 
external channel interface. 


In the Cortex-A73 processor CTM, the external channel output is driven by the OR output of all internal 
channel outputs. Each internal channel input is driven by the OR output of internal channel outputs of all 
other CTIs in addition to the external channel input. 
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13.4 


This section describes the cross trigger registers in the Cortex-A73 processor. These registers are 
accessed through the external debug interface. 


Cross trigger register summary 


13 Cross Trigger 
13.4 Cross trigger register summary 


The following table gives a summary of the Cortex-A73 cross trigger registers. For those registers not 
described in this chapter, see the ARM" Architecture Reference Manual ARMvé, for ARMv8-A 




















































































































architecture profile. 
Table 13-3 Cross trigger register summary 
Offset Name Type | Description 
0x000 CTICONTROL RW |CTI Control Register 
0x000-0X0OC | - - Reserved 
0x010 CTIINTACK WO |CTI Output Trigger Acknowledge Register 
0x014 CTIAPPSET RW | CTI Application Trigger Set Register 
0x018 CTIAPPCLEAR WO | CTI Application Trigger Clear Register 
@x@1C CTIAPPPULSE WO | CTI Application Pulse Register 
0x020 CTIINENO RW | CTI Input Trigger to Output Channel Enable Registers 
0x024 CTIINEN1 RW 
0x028 CTIINEN2 RW 
@x@2C CTIINEN3 RW 
0x030 CTIINEN4 RW 
0x034 CTIINEN5 RW 
0x038 CTIINEN6 RW 
@x@3C CTIINEN7 RW 
0x040-0X09C | - - Reserved 
Qx0AO CTIOUTENO RW _ | CTI Input Channel to Output Trigger Enable Registers 
Ox0@A4 CTIOUTEN1 RW 
Ox0A8 CTIOUTEN2 RW 
@x@AC CTIOUTEN3 RW 
@x@Be CTIOUTEN4 RW 
@x@B4 CTIOUTENS RW 
O@x@B8 CTIOUTEN6 RW 
@x@BC CTIOUTEN7 RW 
@x@CO-@x12C | - - Reserved 
0x130 CTITRIGINSTATUS RO | CTI Trigger In Status Register 
0x134 CTITRIGOUTSTATUS | RO |CTI Trigger Out Status Register 
0x138 CTICHINSTATUS RO | CTI Channel In Status Register 
@x13C CTICHOUTSTATUS |RO_ | CTI Channel Out Status Register 
0x140 CTIGATE RW | CTI Channel Gate Enable Register 
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Table 13-3 Cross trigger register summary (continued) 





































































































Offset Name Type | Description 

@x144-@xF7C | - - Reserved 

OxFee CTIUTCTRL RW | 13.5.2 CTI Integration Mode Control Register on page 13-534 

OxFQ4-@xFA4 |- - Reserved 

OxFA@ CTICLAIMSET RW | CTI Claim Tag Set Register 

OxFA4 CTICLAIMCLR RW | CTI Claim Tag Clear Register 

OxFA8 CTIDEVAFFO RO | CTI Device Affinity Register 0 

OxFAC CTIDEVAFFI1 RO | CTI Device Affinity Register 1 

@xFBO CTILAR WO | CTI Lock Access Register 

OxFB4 CTILSR RO | CTI Lock Status Register 

OxFB8 CTIAUTHSTATUS RO | CTI Authentication Status Register 

OxFBC CTIDEVARCH RO | CTI Device Architecture Register 

OxFCO CTIDEVID2 RO | CTI Device ID Register 2 

OxFC4 CTIDEVID1 RO | CTI Device ID Register 1 

OxFC8 CTIDEVID RO | 13.5.1 CTI Device Identification Register on page 13-533 

OxFCC CTIDEVTYPE RO | CTI Device Type Register 

@xFDO CTIPIDR4 RO | Peripheral Identification Register 4 on page 13-538 

@xFD4 CTIPIDRS5 RO | Peripheral Identification Register 5-7 on page 13-539 

@xFD8 CTIPIDR6 RO 

@xFDC CTIPIDR7 RO 

OxFEO CTIPIDRO RO | Peripheral Identification Register 0 on page 13-535 

OxFE4 CTIPIDR1 RO | Peripheral Identification Register 1 on page 13-536 

OxFE8 CTIPIDR2 RO | Peripheral Identification Register 2 on page 13-536 

OxFEC CTIPIDR3 RO | Peripheral Identification Register 3 on page 13-537 

OxFFO CTICIDRO RO | Component Identification Register 0 on page 13-539 

OxFF4 CTICIDR1 RO | Component Identification Register 1 on page 13-540 

OxFF8 CTICIDR2 RO | Component Identification Register 2 on page 13-540 

@xFFC CTICIDR3 RO | Component Identification Register 3 on page 13-541 
13.4.1 External register access permissions 


External access permission to the cross trigger registers is subject to the conditions at the time of the 
access. The following table describes the processor response to accesses through the external debug and 
memory-mapped interfaces. 
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13.4 Cross trigger register summary 


Table 13-4 External register conditions 





Name | Condition Description 





Off EDPRSR.PU is @ Processor power domain is completely off, or in a low-power state where the 
processor power domain registers cannot be accessed. 





DLK | EDPRSR.DLK is 1 OS Double Lock is locked. 





OSLK | OSLSR_EL1.OSLK is 1 OS Lock is locked. 





EDAD | AllowExternalDebugAccess()==FALSE | External debug access is disabled. When an error is returned because of an 
EDAD condition code, and this is the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise EDPRSR.SDAD is unchanged. 





SLK Memory-mapped interface only Software lock is locked. For the external debug interface, ignore this row. 





Default None of the conditions apply, normal access. 

















The following table shows an example of external register condition codes for access to a cross trigger 
register. To determine the access permission for the register, scan the columns from left to right. Stop at 
the first column a condition is true, the entry gives the access permission of the register and scanning 





























stops. 
Table 13-5 External register condition code example 
Off | DLK | OSLK | EDAD | SLK | Default 
- - - - RO/WI | RO 
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13.5 Cross trigger register descriptions 


This section contains the following subsections: 

e 13.5.1 CTI Device Identification Register on page 13-533. 

e 13.5.2 CTI Integration Mode Control Register on page 13-534. 
e 13.5.3 CTI Peripheral Identification Registers on page 13-534. 
¢ 13.5.4 Component Identification Registers on page 13-539. 


13.5.1 CTI Device Identification Register 
The CTIDEVID characteristics are: 


Purpose Describes the CTI component to the debugger. 
Usage constraints The accessibility of the CTIDEVID register by condition code is: 


Off | DLK | OSLK | EDAD | SLK | Default 





- - - - RO |RO 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTIDEVID register is in the Debug power domain. 
Attributes The CTIDEVID is a 32-bit register. 


The following figure shows the CTIDEVID bit assignments. 


26 25 24 23 22 21 16.15 14 13 87654 


INOUT + 
Figure 13-2 CTIDEVID bit assignments 
The following table shows the CTIDEVID bit assignments. 


Table 13-6 CTIDEVID bit assignments 














Bits |Name Function 

[31:26] | - Reserved, RESO. 

[25:24] | INOUT Input and output options. Indicates the presence of an input gate. The possible values are: 
e@bee CTIGATE does not mask propagation of input events from external channels. 
@be1 CTIGATE masks propagation of input events from external channels. 

[23:22] | - Reserved, RESO. 





[21:16] | NUMCHAN Number of channels implemented. This value is: 
0b000100 Four channels implemented. 





[15:14] | - Reserved, RESO. 





[13:8] | NUMTRIG Number of triggers implemented. This value is: 
0b0010009 Eight triggers implemented. 
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Table 13-6 CTIDEVID bit assignments (continued) 





Bits Name Function 





[7:5] - Reserved, RESO. 





[4:0] | EXTMAXNUM | Maximum number of external triggers implemented. This value is: 
@beeee0 No external triggers implemented. 

















The CTIDEVID register can be accessed through the external debug interface with offset @xFC8. 


13.5.2 CTI Integration Mode Control Register 
The CTIUTCTRL characteristics are: 


Purpose The CTUTCTRL register shows that the Cortex-A73 processor does not implement 
an integration mode. 


Usage constraints The accessibility of the CTUTCTRL register by condition code is: 





Off | DLK | OSLK | EDAD | SLK | Default 





- - - - RO/WI | RW 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTIITCTRL register is in the Debug power domain. 
Attributes The CTHTCTRL is a 32-bit register. 


The following figure shows the CTIITCTRL bit assignments. 


31 10 
Pm 
IME — 


Figure 13-3 CTIITCTRL bit assignments 
The following table shows the CTIITCTRL bit assignments. 


Table 13-7 CTIITCTRL bit assignments 





Bits | Name | Function 





[31:1] Reserved, RESO. 





[0] IME _ | Integration mode enable. The possible value is: 


2) Normal operation. 

















The CTIITCTRL register can be accessed through external debug interface with offset @xFee. 


13.5.3 CTI Peripheral Identification Registers 


The Peripheral Identification Registers provide standard information required for all components that 
conform to the ARM CoreSight architecture. There is a set of eight registers, listed in register number 
order in the following table. 
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Table 13-8 Summary of the Peripheral Identification Registers 





Register Value | Offset 





Peripheral ID4 | 0x04 | @xFD@ 





Peripheral ID5 | 0x00 | OxFD4 





Peripheral ID6 | 0x00 | OxFD8 





Peripheral ID7 | 0x00 | @xFDC 





Peripheral IDO | @xAA | @xFE@ 





Peripheral ID1 | @xB9 | OxFE4 





Peripheral ID2 | @x@B | O@xFE8 





Peripheral ID3 | 0x00 | OxFEC 

















Only bits[7:0] of each Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
Peripheral ID Registers define a single 64-bit Peripheral ID. 


The Peripheral ID registers are: 

e Peripheral Identification Register 0 on page 13-535. 

e Peripheral Identification Register 1 on page 13-536. 

e Peripheral Identification Register 2 on page 13-536. 

¢ Peripheral Identification Register 3 on page 13-537. 

e Peripheral Identification Register 4 on page 13-538. 

¢ Peripheral Identification Register 5-7 on page 13-539. 


Peripheral Identification Register 0 
The CTIPIDRO characteristics are: 


Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTIPIDRO by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 


























= la a - RO |RO 





Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTIPIDRO is in the Debug power domain and is optional to implement in the 
external register interface. 


Attributes The CTIPIDRO is a 32-bit register. 
The following figure shows the CTIPIDRO bit assignments. 


31 8 7 0 


Figure 13-4 CTIPIDRO bit assignments 
The following table shows the CTIPIDRO bit assignments. 
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Table 13-9 CTIPIDRO bit assignments 






















































































Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:0] | Part_0 | gxan Least significant byte of the cross trigger part number. 
The CTIPIDRO can be accessed through the external debug interface with offset @xFE@. 
Peripheral Identification Register 1 
The CTIPIDR1 characteristics are: 
Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTIPIDR1 by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
- - - - RO |RO 
Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 
Configurations The CTIPIDR1 is in the Debug power domain and is optional to implement in the 
external register interface. 
Attributes The CTIPIDR1 is a 32-bit register. 
The following figure shows the CTIPIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 13-5 CTIPIDR1 bit assignments 
The following table shows the CTIPIDR1 bit assignments. 
Table 13-10 CTIPIDR1 bit assignments 
Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | DES 0] exp ARM Limited. This is the least significant nibble of JEP106 ID code. 
[3:0] | Part_! | @x9 Most significant nibble of the CTI part number. 
The CTIPIDR1 can be accessed through the external debug interface with offset @xFE4. 
Peripheral Identification Register 2 
The CTIPIDR2 characteristics are: 
Purpose Provides information to identify a CTI component. 
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Usage constraints The accessibility of the CTIPIDR2 by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTIPIDR2 is in the Debug power domain and is optional to implement in the 
external register interface. 


Attributes The CTIPIDR2 is a 32-bit register. 


The following figure shows the CTIPIDR2 bit assignments. 


31 8 7 43 2 0 
JEDEC — 


Figure 13-6 CTIPIDR2 bit assignments 
The following table shows the CTIPIDR2 bit assignments. 


Table 13-11 CTI PIDR2 bit assignments 





Bits 


Name 


Function 





[31:8] 


Reserved, RESO. 





[7:4] 


Revision 


0x0 r0po. 





[3] 


JEDEC 


@b1 RES1. Indicates a JEP106 identity code is used. 





[2:0] 








DES 1 





b011 ARM Limited. This is the most significant nibble of JEP106 ID code. 








CTIPIDR2 can be accessed through the external debug interface, offset @xFE8. 


Peripheral Identification Register 3 
The CTIPIDR3 characteristics are: 


Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTIPIDR3 register by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





tie le g RO |RO 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTIPIDR3 register is in the Debug power domain and is optional to implement 
in the external register interface. 


Attributes The CTIPIDR3 is a 32-bit register. 


The following figure shows the CTIPIDR3 bit assignments. 
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31 8 7 4 3 0 


Figure 13-7 CTIPIDR3 bit assignments 
The following table shows the CTIPIDR3 bit assignments. 


Table 13-12 CTIPIDR3 bit assignments 






















































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | REVAND | 9x9 Part minor revision. 
[3:0] |CMOD | exe Customer modified. 
The CTIPIDR3 register can be accessed through the external debug interface with offset @xFEC. 
Peripheral Identification Register 4 
The CTIPIDR4 characteristics are: 
Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTIPIDR4 register by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
et les : - RO [RO 
Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 
Configurations The CTIPIDR4 register is in the Debug power domain and is optional to implement 
in the external register interface. 
Attributes The CTIPIDR4 is a 32-bit register. 
The following figure shows the CTIPIDR4 bit assignments. 
31 8 7 4 3 0 
Figure 13-8 CTIPIDR4 bit assignments 
The following table shows the CTIPIDR4 bit assignments. 
Table 13-13 CTIPIDR4 bit assignments 
Bits | Name | Function 
[31:8] | - Reserved, RESO. 
[7:4] | Size Ox@ Size of the component. Log of the number of 4KB pages from the start of the component to the end of 
the component ID registers. 
[3:0] | DES 2) Qx4 ARM Limited. This is the least significant nibble of the JEP 106 continuation code. 
The CTIPIDR4 register can be accessed through the external debug interface with offset @xFD@. 
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Peripheral Identification Register 5-7 


No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. They are 
reserved for future use and are RESO. 


13.5.4 Component Identification Registers 


There are four read-only Component Identification Registers, Component IDO through Component ID3. 
The following table shows these registers. 


Table 13-14 Summary of the Component Identification Registers 





Register Value | Offset 





Component IDO | @x@D | @xFF@ 





Component ID1 | 0x90 | @xFF4 





Component ID2 | 0x05 | OxFF8 








Component ID3 | @xB1 | @xFFC 














The Component ID registers are: 

e Component Identification Register 0 on page 13-539. 
e Component Identification Register 1 on page 13-540. 
e Component Identification Register 2 on page 13-540. 
e Component Identification Register 3 on page 13-541. 


Component Identification Register 0 
The CTICIDRO characteristics are: 


Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTICIDRO register by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTICIDRO register is in the Debug power domain and is optional to implement 
in the external register interface. 


Attributes The CTICIDRO is a 32-bit register. 


The following figure shows the CTICIDRO bit assignments. 


31 8 7 0 


Figure 13-9 CTICIDRO bit assignments 
The following table shows the CTICIDRO bit assignments. 
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Table 13-15 CTICIDRO bit assignments 






















































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 0 | @xep Preamble byte 0. 
The CTICIDRO register can be accessed through the external debug interface with offset @xFF@. 
Component Identification Register 1 
The CTICIDR1 characteristics are: 
Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTICIDR1 register by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
a : a RO [RO 
Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 
Configurations The CTICIDRI1 register is in the Debug power domain and is optional to implement 
in the external register interface. 
Attributes The CTICIDR1 is a 32-bit register. 
The following figure shows the CTICIDR1 bit assignments. 
31 8 7 4 3 0 
Figure 13-10 CTICIDR1 bit assignments 
The following table shows the CTICIDR1 bit assignments. 
Table 13-16 CTICIDR1 bit assignments 
Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | CLASS 0x9 Debug component. 
[3:0] | PRMBL_1 | @x@ Preamble byte 1. 
The CTICIDR1 register can be accessed through external debug interface with offset @xFF4. 
Component Identification Register 2 
The CTICIDR2 characteristics are: 
Purpose Provides information to identify a CTI component. 
ARM 100048 _0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 13-540 
reserved. 


Non-Confidential 





13 Cross Trigger 
13.5 Cross trigger register descriptions 


Usage constraints The accessibility of the CTICIDR2 register by condition code is: 





Off | DLK | OSLK | EPMAD | SLK | Default 





- - - - RO |RO 


























Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 


Configurations The CTICIDR2 register is in the Debug power domain and is optional to implement 
in the external register interface. 


Attributes The CTICIDR2 is a 32-bit register. 


The following figure shows the CTICIDR2 bit assignments. 


31 8 7 0 


Figure 13-11 CTICIDR2 bit assignments 
The following table shows the CTICIDR2 bit assignments. 


Table 13-17 CTICIDR2 bit assignments 
























































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 2 | gx@5 Preamble byte 2. 
The CTICIDR2 register can be accessed through the external debug interface with offset @xFF8. 
Component Identification Register 3 
The CTICIDR3 characteristics are: 
Purpose Provides information to identify a CTI component. 
Usage constraints The accessibility of the CTICIDR3 register by condition code is: 
Off | DLK | OSLK | EPMAD | SLK | Default 
- - - - RO |RO 
Table 13-4 External register conditions on page 13-532 describes the condition 
codes. 
Configurations The CTICIDR3 register is in the Debug power domain and is optional to implement 
in the external register interface. 
Attributes The CTICIDR3 is a 32-bit register. 
The following figure shows the CTICIDR3 bit assignments. 
31 8 7 0 
Figure 13-12 CTICIDR3 bit assignments 
The following table shows the CTICIDR3 bit assignments. 
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Table 13-18 CTICIDR3 bit assignments 




















Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:0] | PRMBL 3 |øxB1 Preamble byte 3. 








The CTICIDR3 register can be accessed through the external debug interface with offset @xFFC. 
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Chapter 14 
Advanced SIMD and Floating-point Support 


This chapter describes the Advanced SIMD and floating-point features and registers in the Cortex-A73 
processor. 


It contains the following sections: 

¢ 14.1 About the Advanced SIMD and Floating-point support on page 14-544. 
e 14.2 Floating-point support on page 14-545. 

¢ 14.3 Accessing the feature identification registers on page 14-546. 

e 14.4 AArch64 register summary on page 14-547. 

¢ 14.5 AArch64 register descriptions on page 14-548. 

e 14.6 AArch32 register summary on page 14-556. 

e 14.7 AArch32 register descriptions on page 14-557. 
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14.1 About the Advanced SIMD and Floating-point support 


14.1 About the Advanced SIMD and Floating-point support 


The Cortex-A73 processor supports the Advanced SIMD and floating-point instructions in the A64, A32, 
and T32 instruction sets. 


The ARMv8 architecture does not define a separate version number for its Advanced SIMD and floating- 
point support in the AArch64 execution state because the instructions are always implicitly present. 
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14.2 Floating-point support 


14.2 Floating-point support 
The Cortex-A73 floating-point implementation: 
e Does not generate floating-point exceptions. 


¢ Implements all operations in hardware, with support for all combinations of: 


— Rounding modes. 
— Flush-to-zero, which can be enabled or not enabled. 
— Default Not a Number (NaN) modes, which can be enabled or not enabled. 
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14.3 Accessing the feature identification registers 


Software can identify the Advanced SIMD and floating-point features using the feature identification 
registers in the AArch64 and AArch32 Execution states. 


You can access the feature identification registers in the AArch64 Execution state using the MRS 
instructions, for example: 


MRS <Xt>, MVFR@_EL1 
MRS <Xt>, MVFR1_EL1 
MRS <Xt>, MVFR2_EL1 


3 Read MVFR@_EL1 into Xt 
3 Read MVFR1_EL1 into Xt 
3 Read MVFR2_EL1 into Xt 


You can access the feature identification registers in the AArch32 Execution state using the VMRS 
instructions, for example: 


VMRS <Rt>, FPSID 


VMRS <Rt>, MVFR1 


Read FPSID into Rt 


Read MFFR1 into Rt 


3 

VMRS <Rt>, MVFR@ ; Read MVFR@ into Rt 
3 
3 


VMRS <Rt>, MVFR2 


Read MVFR2 into Rt 


The following table lists the feature identification registers for Advanced SIMD and floating-point 


support. 


Table 14-1 Advanced SIMD and floating-point feature identification registers 





AArch64 name 


AArch32 name 


Description 























- FPSID See 14.7.1 Floating-point System ID Register on page 14-557. 
MVFRO_ EL1 MVFRO See: 

¢ 14.5.3 Media and VFP Feature Register 0, ELI on page 14-550 (AArch64). 

e 14.7.3 Media and Floating-point Feature Register 0 on page 14-560 (AArch32). 
MVFRI1 EL1 MVFRI1 See: 

e 14.5.4 Media and VFP Feature Register 1, ELI on page 14-552 (AArch64). 

¢ 14.7.4 Media and Floating-point Feature Register 1 on page 14-562 (AArch32). 
MVFR2 EL1 MVFR2 See: 


e 14.5.5 Media and VFP Feature Register 2, ELI on page 14-553 (AArch64). 
¢ 14.7.5 Media and Floating-point Feature Register 2 on page 14-563 (AArch32). 
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14.4 AArch64 register summary 


The following table gives a summary of the Cortex-A73 processor Advanced SIMD and floating-point 
system registers in the AArch64 execution state. 


Table 14-2 AArch64 Advanced SIMD and floating-point system registers 












































Name Type | Reset Description 

FPCR RW | 0x000008@8 | See 74.5.1 Floating-point Control Register on page 14-548. 

FPSR RW _ | 0x000008@8O | See 74.5.2 Floating-point Status Register on page 14-549. 

MVFRO ELI |RO | 0x10110222 | See 74.5.3 Media and VFP Feature Register 0, ELI on page 14-550. 

MVFRI ELI |RO | 0x12111111 | See 74.5.4 Media and VFP Feature Register 1, ELI on page 14-552. 

MVFR2_ FLI |RW_ | 0x00@000043 | See 14.5.5 Media and VFP Feature Register 2, EL] on page 14-553. 

FPEXC32_EL2|RW_ |@0x00000700 | See 74.5.6 Floating-point Exception Control Register 32, EL2 on page 14-554. 
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14.5 AArch64 register descriptions 
This section describes the AArch64 Advanced SIMD and floating-point system registers in the Cortex- 
A73 processor. 
Table 14-2 AArch64 Advanced SIMD and floating-point system registers on page 14-547 provides cross- 
references to individual registers. 
This section contains the following subsections: 
¢ 14.5.1 Floating-point Control Register on page 14-548. 
e 14.5.2 Floating-point Status Register on page 14-549. 
¢ 14.5.3 Media and VFP Feature Register 0, ELI on page 14-550. 
¢ 14.5.4 Media and VFP Feature Register 1, ELI on page 14-552. 
¢ 14.5.5 Media and VFP Feature Register 2, ELI on page 14-553. 
¢ 14.5.6 Floating-point Exception Control Register 32, EL2 on page 14-554. 
14.5.1 Floating-point Control Register 
The FPCR characteristics are: 
Purpose Controls floating-point support behavior. 
Usage The accessibility to the FPCR by Exception level is: 
constraints 
ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 
RW | RW RW RW | RW RW 
Configurations The named fields in this register map to the equivalent fields in the AArch32 
FPSCR. See /4.7.2 Floating-point Status and Control Register on page 14-558. 
Attributes The FPCR is a 32-bit register. 
The following figure shows the FPCR bit assignments. 
27 26 25 24 23 22 21 0 
i = 
Figure 14-1 FPCR bit assignments 
The following table shows the FPCR bit assignments. 
Table 14-3 FPCR bit assignments 
Bits | Name | Function 
[31:27] | - Reserved, RESO. 
[26] AHP _ | Alternative half-precision control bit. The possible values are: 
2) IEEE half-precision format selected. 
1 Alternative half-precision format selected. 
[25] DN Default NaN mode control bit. The possible values are: 
7) NaN operands propagate through to the output of a floating-point operation. 
1 Any operation involving one or more NaNs returns the Default NaN. 
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Table 14-3 FPCR bit assignments (continued) 






















































































Bits | Name | Function 
[24] FZ Flush-to-zero mode control bit. The possible values are: 
(3 Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant with the IEEE 754 
standard. 
1 Flush-to-zero mode enabled. 
[23:22] | RMode | Rounding Mode control field. The encoding of this field is: 
@bee Round to Nearest (RN) mode. 
@be1 Round towards Plus Infinity (RP) mode. 
@b18 Round towards Minus Infinity (RM) mode. 
@b11 Round towards Zero (RZ) mode. 
[21:0] |- Reserved, RESO. 
To access the FPCR in AArch64 state, read or write the register with: 
MRS <Xt>, FPCR; Read FPCR into Xt 
MSR FPCR, <Xt>; Write Xt to FPCR 
The following table shows the register access encoding. 
Table 14-4 FPCR access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 011 |01000100 | 000 
14.5.2 Floating-point Status Register 
The FPSR characteristics are: 
Purpose Provides floating-point system status information. 
Usage The accessibility to the FPSR by Exception level is: 
constraints 
ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 
RW | RW RW RW | RW RW 
Configurations The FPSR is part of the floating-point functional group. 
The named fields in this register map to the equivalent fields in the AArch32 FPSCR. 
See 74.7.2 Floating-point Status and Control Register on page 14-558. 
Attributes The FPSR is a 32-bit register. 
Note 
AArch64 floating-point comparisons set flags in the PSTATE register instead. 
The following figure shows the FPSR bit assignments. 
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31 30 29 28 27 26 876543 21 0 





L_ac IDC— ixc—! L— ioc 
UFC DZC 
OFC 


Figure 14-2 FPSR bit assignments 
The following table shows the FPSR bit assignments. 


Table 14-5 FPSR bit assignments 




























































































Bits | Name | Function 
[31] IN Negative condition flag for AArch32 floating-point comparison operations. 
[B0] |Z Zero condition flag for AArch32 floating-point comparison operations. 
[29] IC Carry condition flag for AArch32 floating-point comparison operations. 
[28] IV Overflow condition flag for AArch32 floating-point comparison operations. 
[27] QC Cumulative saturation bit, Advanced SIMD only. This bit is set to 1 to indicate that an Advanced SIMD integer 
operation has saturated since 0 was last written to this bit. 
[26:8] | - Reserved, RESO. 
[7] IDC | Input Denormal cumulative exception bit. This bit is set to 1 to indicate that the Input Denormal exception has 
occurred since a 0 was last written to this bit. 
[6:5] |- Reserved, RESO. 
[4] IXC |Inexact cumulative exception bit. This bit is set to 1 to indicate that the Inexact exception has occurred since 0 was 
last written to this bit. 
[3] UFC | Underflow cumulative exception bit. This bit is set to 1 to indicate that the Underflow exception has occurred since 0 
was last written to this bit. 
[2] OFC | Overflow cumulative exception bit. This bit is set to 1 to indicate that the Overflow exception has occurred since 0 
was last written to this bit. 
[1] DZC | Division by Zero cumulative exception bit. This bit is set to 1 to indicate that the Division by Zero exception has 
occurred since 0 was last written to this bit. 
[0] IOC Invalid Operation cumulative exception bit. This bit is set to 1 to indicate that the Invalid Operation exception has 
occurred since 0 was last written to this bit. 
To access the FPSR in AArch64 state, read or write the register with: 
MRS <Xt>, FPSR; Read FPSR into Xt 
MSR FPSR, <Xt>; Write Xt to FPSR 
The following table shows the register access encoding. 
Table 14-6 FPSR access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 011 |0100 |0100 | 001 
14.5.3 Media and VFP Feature Register 0, EL1 
The MVFRO ELI characteristics are: 
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Purpose The MVFRO_EL1 must be interpreted with the MVFR1_EL1 and the MVFR2_EL1 

to describe the features provided by Advanced SIMD and floating-point support. 
Usage The accessibility to the MVFRO_EL1 in AArch64 state by Exception level is: 
constraints 


ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 





- RO RO RO |RO RO 























Configurations The MVFRO_ EL] is architecturally mapped to AArch32 register MVFRO. See 


14.7.3 Media and Floating-point Feature Register 0 on page 14-560. 


Attributes The MVFRO_ ELI is a 32-bit register. 


The following figure shows the MVFRO_EL1 bit assignments. 


28 27 24 23 20 19 1615 12 11 


FPRound | FPShVec FPSart FPDivide FPTrap FPDP FPSP SIMDReg 


Figure 14-3 MVFRO_EL1 bit assignments 


The following table shows the MVFRO_ ELI bit assignments. 


Table 14-7 MVFRO_EL1 bit assignments 


















































Bits |Name Function 
[31:28] | FPRound | Indicates the rounding modes supported by the floating-point hardware: 
@x1 All rounding modes supported. 
[27:24] | FPShVec | Indicates the hardware support for floating-point short vectors: 
0x0 Not supported. 
[23:20] | FPSqrt Indicates the hardware support for floating-point square root operations: 
0x1 Supported. 
[19:16] | FPDivide | Indicates the hardware support for floating-point divide operations: 
0x1 Supported. 
[15:12] | FPTrap Indicates whether the floating-point hardware implementation supports exception trapping: 
0x0 Not supported. 
[11:8] | FPDP Indicates the hardware support for floating-point double-precision operations: 
0x2 Supported, VFPv3 or greater. 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 
[7:4] | FPSP Indicates the hardware support for floating-point single-precision operations: 
0x2 Supported, VFPv3 or greater. 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 
[3:0] SIMDReg | Indicates support for the Advanced SIMD register bank: 
0x2 32x64-bit registers supported. 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 
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To access the MVFRO_ ELI: 


MRS <Xt>, MVFR@_EL1 ; Read MVFR@_EL1 into Xt 


The following table shows the register access encoding. 


Table 14-8 MVFRO_EL1 access encoding 





op0 | op1 | CRn | CRm | op2 




















11 | 000 |0000 |0011 | 000 







































































14.5.4 Media and VFP Feature Register 1, EL1 
The MVFRI ELI characteristics are: 
Purpose The MVFR1_EL1 must be interpreted with the MVFRO_EL1 and the MVFR2_EL1 
to describe the features provided by Advanced SIMD and floating-point support. 
Usage The accessibility to the MVFR1_EL1 in AArch64 state by Exception level is: 
constraints 
ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 
- RO RO RO |RO RO 
Configurations The MVFRI1_ EL] is architecturally mapped to AArch32 register MVFR1. See 
14.7.4 Media and Floating-point Feature Register I on page 14-562. 
Attributes The MVFRI1_ELI is a 32-bit register. 
The following figure shows the MVFR1_EL1 bit assignments. 
28 27 24 23 20 19 16 15 12 11 
Figure 14-4 MVFR1_EL1 bit assignments 
The following table shows the MVFR1_ELI bit assignments. 
Table 14-9 MVFR1_EL1 bit assignments 
Bits |Name Function 
[31:28] | SIMDFMAC | Indicates whether Advanced SIMD or floating-point supports fused multiply accumulate operations: 
0x1 Implemented. 
[27:24] | FPHP Indicates whether floating-point supports half-precision floating-point conversion operations: 
0x2 Instructions to convert between half-precision and single-precision, and between half-precision and 
double-precision are implemented. 
[23:20] | SIMDHP Indicates whether Advanced SIMD supports half-precision floating-point conversion operations: 
0x1 Implemented. 
[19:16] | SIMDSP Indicates whether Advanced SIMD supports single-precision floating-point operations: 
0x1 Implemented. 
[15:12] | SIMDInt Indicates whether Advanced SIMD supports integer operations: 
0x1 Implemented. 
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Table 14-9 MVFR1_EL1 bit assignments (continued) 





















































Bits |Name Function 
[11:8] | SIMDLS Indicates whether Advanced SIMD supports load/store instructions: 
0x1 Implemented. 
[7:4] | FPDNaN Indicates whether the floating-point hardware implementation supports only the Default NaN mode: 
0x1 Hardware supports propagation of NaN values. 
[3:0] FPFtZ Indicates whether the floating-point hardware implementation supports only the Flush-to-Zero mode of 
operation: 
0x1 Hardware supports full denormalized number arithmetic. 
To access the MVFR1_EL1: 
MRS <Xt>, MVFR1_EL1 ; Read MVFR1_EL1 into Xt 
The following table shows the register access encoding. 
Table 14-10 MVFR1_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
11 |000 |0000 | 0011 | 001 
14.5.5 Media and VFP Feature Register 2, EL1 
The MVFR2_ ELI characteristics are: 
Purpose The MVFR2_EL1 must be interpreted with the MVFRO_EL1 and the MVFR1_EL1 
to describe the features provided by Advanced SIMD and floating-point support. 
Usage The accessibility to the MVFR2_EL1 in AArch64 state by Exception level is: 
constraints 
ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 





RO 








RO 





RO 





RO 


RO 











Configurations The MVFR2_ EL] is architecturally mapped to AArch32 register MVFR2. See 
14.7.5 Media and Floating-point Feature Register 2 on page 14-563. 


Attributes The MVFR2_ELI is a 32-bit register. 


The following figure shows the MVFR2_EL1 bit assignments. 


31 


8 7 


4 3 


0 


Figure 14-5 MVFR2_EL1 bit assignments 


The following table shows the MVFR2_ELI bit assignments. 
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Table 14-11 MVFR2_EL1 bit assignments 
















































































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | FPMisc Indicates support for miscellaneous floating-point features. 
0x4 Supports: 
e Floating-point selection. 
e Floating-point Conversion to Integer with Directed Rounding modes. 
e Floating-point Round to Integral Floating-point. 
e Floating-point MaxNum and MinNum. 
[3:0] | SIMDMisc | Indicates support for miscellaneous Advanced SIMD features. 
0x3 Supports: 
e Floating-point Conversion to Integer with Directed Rounding modes. 
e Floating-point Round to Integral Floating-point. 
e Floating-point MaxNum and MinNum. 
To access the MVFR2_ELI: 
MRS <Xt>, MVFR2_EL1 ; Read MVFR2_EL1 into Xt 
The following table shows the register access encoding. 
Table 14-12 MVFR2_EL1 access encoding 
op0 | op1 | CRn | CRm | op2 
0000 | 0011 | 010 
14.5.6 Floating-point Exception Control Register 32, EL2 
The FPEXC32_EL2 characteristics are: 
Purpose Provides access to the AArch32 register FPEXC from AArch6é4 state only. Its value 
has no effect on execution in AArch64 state. 
Usage The accessibility to the FPEXC32_EL2 in AArch64 state by Exception level is: 
constraints 
ELO | EL1(NS) | EL1(S) | EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 
- - - RW | RW RW 
Configurations © FPEXC32_EL2 is architecturally mapped to AArch32 register FPEXC. See 
14.7.6 Floating-Point Exception Control Register on page 14-564. 
Attributes FPEXC32_EL2 is a 32-bit register. 
The following figure shows the FREXC32_EL2 bit assignments. 
31 30 29 11 10 0 
ee | e 
L EN 
EX 
Figure 14-6 FPEXC32_EL2 bit assignments 
The following table shows the FPEXC32_EF12 bit assignments. 
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Table 14-13 FPEXC32_EL2 bit assignments 






























































Bits |Name | Function 
[81] EX Exception bit. 
RESO The Cortex-A73 processor implementation does not generate asynchronous floating-point exceptions. 
[30] EN Enable bit. A global enable for Advanced SIMD and floating-point support: 
7) Advanced SIMD and floating-point support is disabled. 
1 Advanced SIMD and floating-point support is enabled and operates normally. 
This bit applies only to AArch32 execution, and only when EL! is not AArch64. 
[29:11] | - Reserved, RESO. 
[10:8] |- Reserved, RES1. 
[7:0] - Reserved, RESO. 
To access the FREXC_EL2: 
MRS <Xt>, FPEXC32_EL2 ; Read FPEXC32_EL2 into Xt 
MSR FPEXC32_EL2, <Xt> ; Write Xt to FPEXC32_EL2 
See also 74.3 Accessing the feature identification registers on page 14-546. 
The following table shows the register access encoding. 
Table 14-14 FPEXC_EL2 access encoding 
op0 | op1 | CRn | CRm | op2 
11 | 100 |0101 | 0011 | 000 
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14 Advanced SIMD and Floating-point Support 
14.6 AArch32 register summary 


The following table gives a summary of the Cortex-A73 processor Advanced SIMD and floating-point 
system registers in the AArch32 Execution state. 


Table 14-15 AArch32 Advanced SIMD and floating-point system registers 












































Name | Type | Reset Description 

FPSID |RO | 0x41034098 | See 74.7.1 Floating-point System ID Register on page 14-557. 

FPSCR |RW_ |@0x00000000 | See /4.7.2 Floating-point Status and Control Register on page 14-558. 

MVFRO|RO_ | 0x10110222 | See 74.7.3 Media and Floating-point Feature Register 0 on page 14-560. 

MVFRI |RO | @x12111111 | See 74.7.4 Media and Floating-point Feature Register 1 on page 14-562. 

MVFR2 | RW_ | 0x@0000043 | See 74.7.5 Media and Floating-point Feature Register 2 on page 14-563. 

FPEXC |RW_ | 0x0@00007@O | See 74.7.6 Floating-Point Exception Control Register on page 14-564. 
Note 


The floating-point Instruction Registers, FPINST and FPINST2, are not implemented and any attempt to 
access them is UNDEFINED. 





See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for information 
about permitted accesses to the Advanced SIMD and floating-point system registers. 
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14 Advanced SIMD and Floating-point Support 
14.7 AArch32 register descriptions 


This section describes the AArch32 Advanced SIMD and floating-point system registers in the Cortex- 


A73 processor. 


Table 14-15 AArch32 Advanced SIMD and floating-point system registers on page 14-556 provides 


cross-references to individual registers. 


This section contains the following subsections: 


¢ 14.7.1 Floating-point System ID Register on page 14-557. 
¢ 14.7.2 Floating-point Status and Control Register on page 14-558. 


¢ 14.7.3 Media and Floating-point Feature Register 0 on page 14-560. 
¢ 14.7.4 Media and Floating-point Feature Register 1 on page 14-562. 
¢ 14.7.5 Media and Floating-point Feature Register 2 on page 14-563. 


¢ 14.7.6 Floating-Point Exception Control Register on page 14-564. 


14.7.1 Floating-point System ID Register 
The FPSID characteristics are: 








Purpose Provides top-level information about the floating-point implementation. 

Usage The accessibility to the FPSID by Exception level is: 

constraints 
ELO | ELO/EL1 EL1;/EL2 |EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - Config |RO_ | Config | Config RO 


























Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, and HCPTR. {TCP10,TCP11}. For details of which field values 

permit access at specific Exception levels, see the ARM® Architecture Reference 
Manual ARMV8, for ARMv8-A architecture profile. 


This register largely duplicates information held in the MIDR. ARM deprecates use 


of it. 


Configurations There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes The FPSID is a 32-bit register. 


The following figure shows the FPSID bit assignments. 


31 24 23 22 16 15 


sw— 


The following table shows the FPSID bit assignments. 


8 


7 4 3 0 


Figure 14-7 FPSID bit assignments 
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Table 14-16 FPSID bit assignments 





Bits Name 


Function 





[31:24] | Implementer 


Indicates the implementer: 


0x41 ARM Limited. 





[23] |Sw 


Software bit. This bit indicates whether a system provides only software emulation of the floating-point 
instructions: 


e The system includes hardware support for floating-point operations. 





[22:16] | Subarchitecture 


Subarchitecture version number: 


0x03 VFPv3 architecture, or later, with no subarchitecture. The entire floating-point implementation is 
in hardware, and no software support code is required. The MVFRO, MVFR1, and MVFR2 
registers indicate the VFP architecture version. 





[15:8] | Part Number 


Indicates the part number for the floating-point implementation: 


0x40 Cortex-A73 processor. 





[7:4] | Variant 


Indicates the variant number: 


0x9 Cortex-A73 processor. 





[3:0] | Revision 








Indicates the revision number for the floating-point implementation: 


0xð r0p0. 








To access the FPSID register: 


VMRS 


<Rt>, FPSID ; Read FPSID into Rt 


14.7.2 Floating-point Status and Control Register 
The FPSCR characteristics are: 


Purpose Provides floating-point system status information and control. 


Usage 


constraints 


The accessibility to the FPSCR by Exception level is: 





ELO (NS) | ELO (S) | EL1(NS) | EL1(S)|EL2 | EL3(SCR.NS = 1) | EL3(SCR.NS = 0) 





























Config RW Config RW Config | Config RW 





Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, HCPTR.{TCP10,TCP11} and FPEXC.EN. For details of which field 
values allow access at which Exception levels, see the ARM® Architecture Reference 
Manual ARMv8, for ARMv8-A architecture profile. 


Configurations There is one copy of this register that is used in both Secure and Non-secure states. 


The named fields in this register map to the equivalent fields in the AArch64 FPCR 
and FPSR. See /4.5./ Floating-point Control Register on page 14-548 and 
14.5.2 Floating-point Status Register on page 14-549. 


Attributes The FPSCR is a 32-bit register. 


The following figure shows the FPSCR bit assignments. 
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31 30 29 28 27 26 25 24 23 22 21201918 1615 876543 2 1 0 





ac— L— RESO L—IDC L_1oc 
AHP DZC 
DN OFC 
FZ UFC 
RMode IXC 
Stride 





Figure 14-8 FPSCR bit assignments 
The following table shows the FPSCR bit assignments. 


Table 14-17 FPSCR bit assignments 





Bits 


Field 


Function 





[31] 


Floating-point Negative condition code flag. 


Set to 1 if a floating-point comparison operation produces a less than result. 





[30] 


Floating-point Zero condition code flag. 


Set to 1 if a floating-point comparison operation produces an equal result. 





[29] 


Floating-point Carry condition code flag. 


Set to 1 if a floating-point comparison operation produces an equal, greater than, or unordered result. 








[28] 


Floating-point Overflow condition code flag. 


Set to 1 if a floating-point comparison operation produces an unordered result. 








[27] 


QC 


Cumulative saturation bit. 


This bit is set to 1 to indicate that an Advanced SIMD integer operation has saturated after 0 was last written to this 
bit. 





[26] 


AHP 


Alternative Half-Precision control bit: 


[3] IEFE half-precision format selected. 


1 Alternative half-precision format selected. 





[25] 


DN 


Default NaN mode control bit: 
(2 NaN operands propagate through to the output of a floating-point operation. 


1 Any operation involving one or more NaNs returns the Default NaN. 


The value of this bit only controls floating-point arithmetic. AArch32 Advanced SIMD arithmetic always uses the 
Default NaN setting, regardless of the value of the DN bit. 





[24] 








FZ 





Flush-to-zero mode control bit: 


(2 Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant with the IEEE 754 
standard. 


1 Flush-to-zero mode enabled. 


The value of this bit only controls floating-point arithmetic. AArch32 Advanced SIMD arithmetic always uses the 
Flush-to-zero setting, regardless of the value of the FZ bit. 
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Table 14-17 FPSCR bit assignments (continued) 





Bits Field | Function 





[23:22] | RMode | Rounding Mode control field: 


@bee Round to Nearest (RN) mode. 

@be1 Round towards Plus Infinity (RP) mode. 
@b10 Round towards Minus Infinity (RM) mode. 
@b11 Round towards Zero (RZ) mode. 


The specified rounding mode is used by almost all scalar floating-point instructions. AArch32 Advanced SIMD 
arithmetic always uses the Round to Nearest setting, regardless of the value of the RMode bits. 





[21:20] | Stride | RESO. 





[19] - Reserved, RESO. 





[18:16] | Len RESO. 


























[15:8] |- Reserved, RESO. 

[7] IDC Input Denormal cumulative exception bit. This bit is set to 1 to indicate that the Input Denormal exception has 
occurred since 0 was last written to this bit. 

[6:5] |- Reserved, RESO. 

[4] IXC Inexact cumulative exception bit. This bit is set to 1 to indicate that the Inexact exception has occurred since 0 was 
last written to this bit. 

[3] UFC | Underflow cumulative exception bit. This bit is set to 1 to indicate that the Underflow exception has occurred since 
0 was last written to this bit. 

[2] OFC Overflow cumulative exception bit. This bit is set to 1 to indicate that the Overflow exception has occurred since 0 
was last written to this bit. 

[1] DZC | Division by Zero cumulative exception bit. This bit is set to 1 to indicate that the Division by Zero exception has 
occurred since 0 was last written to this bit. 

[0] IOC Invalid Operation cumulative exception bit. This bit is set to 1 to indicate that the Invalid Operation exception has 





occurred since 0 was last written to this bit. 

















To access the FPSCR: 


VMRS <Rt>, FPSCR ; Read FPSCR into Rt 
VMSR FPSCR, <Rt> ; Write Rt to FPSCR 


Note 


The Cortex-A73 processor implementation does not support the deprecated floating-point short vector 
feature. 








14.7.3 Media and Floating-point Feature Register 0 
The MVFRO characteristics are: 


Purpose The MVFRO must be interpreted with the MVFR1 and the MVFR2 to describe the 
features provided by Advanced SIMD and floating-point support. 
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Usage The accessibility to the MVFRO by Exception level is: 

constraints 
ELO | ELO | EL1 EL1|EL2 |EL3 EL3 
(NS) | (S) | (NS) |(S) (SCR.NS = 1) | (SCR.NS = 0) 
- - Config | RO | Config | Config RO 


























Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, and HCPTR. {TCP10,TCP11}. For details of which field values allow 
access at which Exception levels, see the ARM® Architecture Reference Manual 
ARMVv8, for ARMv8-A architecture profile. 


Configurations MVFRO is architecturally mapped to AArch64 register MVFRO ELI. See 
14.5.3 Media and VFP Feature Register 0, EL] on page 14-550. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes The MVFRO is a 32-bit register. 
The following figure shows the MVFRO bit assignments. 


28 27 24 23 20 19 1615 12 11 


FPRound | FPShVec FPSart FPDivide FPTrap FPDP FPSP SIMDReg 


Figure 14-9 MVFRO bit assignments 
The following table shows the MVFRO bit assignments. 


Table 14-18 MVFRO bit assignments 


















































Bits |Name Function 
[31:28] | FPRound | Indicates the rounding modes supported by the floating-point hardware: 
@x1 All rounding modes supported. 
[27:24] | FPShVec | Indicates the hardware support for floating-point short vectors: 
0x® Not supported. 
[23:20] | FPSqrt Indicates the hardware support for floating-point square root operations: 
0x1 Supported. 
[19:16] | FPDivide | Indicates the hardware support for floating-point divide operations: 
@x1 Supported. 
[15:12] | FPTrap Indicates whether the floating-point hardware implementation supports exception trapping: 
0x® Not supported. 
[11:8] | FPDP Indicates the hardware support for floating-point double-precision operations: 
0x2 Supported, VFPv3 or greater. 
See the ARM” Architecture Reference Manual ARMv8, for ARMv8-A architecture profile for more information. 
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Table 14-18 MVFRO bit assignments (continued) 



























































Bits |Name Function 
[7:4] | FPSP Indicates the hardware support for floating-point single-precision operations: 
0x2 Supported, VFPv3 or greater. 
See the ARM” Architecture Reference Manual ARMVv6, for ARMv8-A architecture profile for more information. 
[3:0] SIMDReg | Indicates support for the Advanced SIMD register bank: 
0x2 Supported, 32 x 64-bit registers supported. 
See the ARM” Architecture Reference Manual, ARMv8, for ARMv8-A architecture profile for more information. 
To access the MVFRO: 
VMRS <Rt>, MVFR@ ; Read MVFR@ into Rt 
14.7.4 Media and Floating-point Feature Register 1 
The MVFRI characteristics are: 
Purpose The MVFRI must be interpreted with the MVFRO and the MVFR2 to describe the 
features provided by Advanced SIMD and floating-point support. 
Usage The accessibility to the MVFR1 by Exception level is: 
constraints 
ELO | ELO |EL1 /|EL1/EL2 |EL3 EL3 
(NS) | (S) | (NS) |(S) (SCR.NS = 1) | (SCR.NS = 0) 
- - Config | RO | Config | Config RO 
Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, HCPTR. {TCP10,TCP11}. For details of which field values allow 
access at which Exception levels, see the ARM” Architecture Reference Manual 
ARMV8, for ARMv8-A architecture profile. 
Configurations MVFR1 is architecturally mapped to AArch64 register MVFR1_EL1. See 
14.5.4 Media and VFP Feature Register 1, ELI on page 14-552. 
There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes The MVFR1 is a 32-bit register. 
The following figure shows the MVFR1 bit assignments. 
28 27 24 23 20 19 16 15 12 11 
Figure 14-10 MVFR1 bit assignments 
The following table shows the MVFRI1 bit assignments. 
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Table 14-19 MVFR1 bit assignments 













































































Bits Name Function 
[31:28] | SIMDFMAC | Indicates whether Advanced SIMD and floating-point supports fused multiply accumulate operations: 
0x1 Implemented. 
[27:24] | FPHP Indicates whether Advanced SIMD and floating-point supports half-precision floating-point conversion 
instructions: 
0x2 Instructions to convert between half-precision and single-precision, and between half-precision and 
double-precision are implemented. 
[23:20] | SIMDHP Indicates whether Advanced SIMD and floating-point supports half-precision floating-point conversion 
operations: 
@x1 Implemented. 
[19:16] | SIMDSP Indicates whether Advanced SIMD and floating-point supports single-precision floating-point operations: 
0x1 Implemented. 
[15:12] | SIMDInt Indicates whether Advanced SIMD and floating-point supports integer operations: 
0x1 Implemented. 
[11:8] | SIMDLS Indicates whether Advanced SIMD and floating-point supports load/store instructions: 
0x1 Implemented. 
[7:4] FPDNaN Indicates whether the floating-point hardware implementation supports only the Default NaN mode: 
0x1 Hardware supports propagation of NaN values. 
[3:0] | FPFtZ Indicates whether the floating-point hardware implementation supports only the Flush-to-Zero mode of 
operation: 
0x1 Hardware supports full denormalized number arithmetic. 
To access the MVFRI: 
VMRS <Rt>, MVFR1 ; Read MVFR1 into Rt 
14.7.5 Media and Floating-point Feature Register 2 
The MVFR2 characteristics are: 
Purpose The MVFR2 must be interpreted with the MVFRO and the MVFRI to describe the 
features provided by Advanced SIMD and floating-point support. 
Usage The accessibility to the MVFR2 by Exception level is: 
constraints 
ELO | ELO | EL1 EL1 | EL2 EL3 EL3 
(NS) | (S) | (NS) |(S) (SCR.NS = 1) | (SCR.NS = 0) 
- - Config| RO | Config | Config RO 
Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, HCPTR. {TCP10,TCP11}. For details of which field values allow 
access at which Exception levels, see the ARM® Architecture Reference Manual, 
ARMV8, for ARMv8-A architecture profile. 
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Configurations MVFR2 is architecturally mapped to AArch64 register MVFR2_ ELI. See 
14.5.5 Media and VFP Feature Register 2, ELI on page 14-553. 


There is one copy of this register that is used in both Secure and Non-secure states. 


Attributes The MVFR2 is a 32-bit register. 


The following figure shows the MVFR2 bit assignments. 
31 8 7 4 3 0 


Figure 14-11 MVFR2 bit assignments 
The following table shows the MVFR2 bit assignments. 


Table 14-20 MVFR2 bit assignments 



























































Bits | Name Function 
[31:8] | - Reserved, RESO. 
[7:4] | FPMisc Indicates support for miscellaneous floating-point features. 
0x4 Supports: 
e Floating-point selection. 
e Floating-point Conversion to Integer with Directed Rounding modes. 
e Floating-point Round to Integral floating-point. 
e Floating-point MaxNum and MinNum. 
[3:0] | SIMDMisc | Indicates support for miscellaneous Advanced SIMD features. 
0x3 Supports: 
e Floating-point Conversion to Integer with Directed Rounding modes. 
e Floating-point Round to Integral floating-point. 
e Floating-point MaxNum and MinNum. 
To access the MVFR2: 
VMRS <Rt>, MVFR2 ; Read MVFR2 into Rt 
14.7.6 Floating-Point Exception Control Register 
The FPEXC characteristics are: 
Purpose Provides a global enable for Advanced SIMD and floating-point support, and 
indicates how the state of this support is recorded. 
Usage The accessibility to the FPEXC by Exception level is: 
constraints 
ELO ;ELO/;EL1 |EL1/EL2 |EL3 EL3 
(NS) | (S) | (NS) | (S) (SCR.NS = 1) | (SCR.NS = 0) 
- - Config | RW | Config | Config RW 
Access to this register depends on the values of CPACR. {CP10,CP11}, NSACR. 
{CP10,CP11}, and HCPTR. {TCP10,TCP11}. For details of which field values allow 
access at which Exception levels, see the ARM® Architecture Reference Manual 
ARMvVv8, for ARMv8-A architecture profile. 
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Configurations FPEXC is architecturally mapped to AArch64 register FPEXC32_EL2. See 
14.5.6 Floating-point Exception Control Register 32, EL2 on page 14-554. 


There is one copy of this register that is used in both Secure and Non-secure states. 
Attributes FPEXC is a 32-bit register. 


The following figure shows the FPEXC bit assignments. 
31 30 29 11 10 8 7 0 


L EN 
EX 
Figure 14-12 FPEXC bit assignments 


The following table shows the FPEXC Register bit assignments. 


Table 14-21 FPEXC bit assignments 



































Bits |Name | Function 
[31] EX Exception bit. The Cortex-A73 processor implementation does not generate asynchronous floating-point exceptions, 
therefore this bit is RESO. 
[30] EN Enable bit. A global enable for Advanced SIMD and floating-point support: 
) Advanced SIMD and floating-point support is disabled. 
1 Advanced SIMD and floating-point support is enabled and operates normally. 
The EN bit is cleared at reset. 
This bit applies only to AArch32 execution, and only when EL! is not AArch64. 
[29:11] | - Reserved, RESO. 
[10:8] | - Reserved, RES1. 
[7:0] - Reserved, RESO. 
To access the FPEXC register: 
VMRS <Rt>, FPEXC ; Read FPEXC into Rt 
See also 74.3 Accessing the feature identification registers on page 14-546. 
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Appendix A 
Signal Descriptions 


This appendix describes the Cortex-A73 processor signals. 


It contains the following sections: 


A.1 About the signal descriptions on page Appx-A-567. 

A.2 Clock signals on page Appx-A-568. 

A.3 Reset signals on page Appx-A-569. 

A.4 Configuration signals on page Appx-A-570. 

A.5 Generic Interrupt Controller signals on page Appx-A-572. 
A.6 Generic Timer signals on page Appx-A-575. 

A.7 Power management signals on page Appx-A-576. 

A.8 L2 error signals on page Appx-A-578. 

A.9 ACE interface signals on page Appx-A-579. 

A.10 ACP interface signals on page Appx-A-584. 

A.11 External debug interface on page Appx-A-587. 

A.12 ATB interface signals on page Appx-A-590. 

A.13 Miscellaneous ETM trace unit signals on page Appx-A-591. 
A.14 CTI interface signals on page Appx-A-592. 

A.15 PMU interface signals on page Appx-A-593. 

A.16 DFT and MBIST interface signals on page Appx-A-594. 





ARM 100048 _0002_05_en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


Appx-A-566 


A Signal Descriptions 
A.1 About the signal descriptions 


A.1 About the signal descriptions 


The tables in this appendix list the Cortex-A73 processor signals, along with their direction, input or 
output, and a high-level description. 


Some of the buses include a configurable width field, <Signal>[CN:0], where CN = 0, 1, 2, or 3, to 
encode up to four cores. For example: 


e nIRQJ[0] represents a core 0 interrupt request. 
e nIRQJ[2] represents a core 2 interrupt request. 


Some signals are specified in the form <signal>x where x = 0, 1, 2 or 3 to reference core 0, core 1, core 
2, core 3. If a core is not present, the corresponding pin is removed. For example: 

e PMUEVENT0[24:0] represents the core 0 PMU event bus. 

e PMUEVENT3[24:0] represents the core 3 PMU event bus. 


The number of signals changes depending on the configuration. For example, the ACP interface signals 
are not present if the ACP interface is not implemented. 
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A.2 Clock signals 


A.2 Clock signals 
The following table shows the clock signals. 


Table A-1 Clock signals 
































Signal Direction | Description 

CLK Input Global clock 

CORECLKEN[CN:90] | Input Core clock enable to generate internal clocks from CLK 

PCLKENDBG Input Clock enable signal to allow the external APB to be clocked at a lower frequency than CLK 
ARM 100048_0002_05_ en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights Appx-A-568 


reserved. 
Non-Confidential 


A.3 


A Signal Descriptions 


Reset signals 


The following table shows the reset and reset control signals. 


A.3 Reset signals 


Table A-2 Reset and reset control signals 





Signal 


Direction | Description 





nCPUPORESET[CN:0] | Input Processor powerup reset: 


@ Apply reset to all processor logic. 


breakpoint and watchpoint logic. 


1 Do not apply reset to all processor logic. 


Processor logic includes Advanced SIMD and floating-point, Debug, ETM trace unit, 





nCORERESET[CN:0] _ | Input Individual core resets excluding Debug and ETM trace unit: 


@ Apply reset to processor logic. 


trace unit, breakpoint and watchpoint logic. 


1 Do not apply reset to processor logic. 


Processor logic includes Advanced SIMD and floating-point, but excludes Debug, ETM 





nL2RESET 


Input L2 memory system reset: 


@ Apply reset to shared L2 memory system controller. 


1 Do not apply reset to shared L2 memory system controller. 





L2RSTDISABLE 


Input Disable automatic L2 cache invalidate at reset: 


Q Hardware resets L2 cache. 


1 Hardware does not reset L2 cache. 








WARMRSTREQ[CN:0] | Output Processor Warm reset request: 


2) Do not apply Warm reset. 
1 Apply Warm reset. 

















Note 
e See nPRESETDBG in Table A-25 APB interface signals on page Appx-A-587. 


e See nMBISTRESET in Table A-32 MBIST interface signals on page Appx-A-594. 
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A Signal Descriptions 
A.4 Configuration signals 


A.4 Configuration signals 


The following table shows the configuration signals. 





Note 


The configurations pins have to be stable during the reset. 





Table A-3 Configuration signals 





Signal Direction | Description 





AA64nAA32[CN:0] Input Register width state: This pin is sampled only during reset of the processor. 


(2) AArch32. 
1 AArch64. 





CFGEND[CN:0] Input Endianness configuration at reset. It sets the initial value of the EE bits in the CP15 
SCTLR_EL3 and SCTR_S registers: 


2) EE bit is LOW. 
1 EE bit is HIGH. 


This pin is sampled only during reset of the processor. 





CFGTE[CN:0] Input Enable T32 exceptions. It sets the initial value of the TE bit in the CP15 SCTLR register: 
@ TE bit is LOW. 
1 TE bit is HIGH. 


This pin is sampled only during reset of the processor. 





CLUSTERIDAFF1[7:0] Input Value read in the Cluster ID Affinity Level 1 field, MPIDR bits[15:8], of the CP15 MPIDR 
register. 


These pins are sampled only during reset of the processor. 





CLUSTERIDAFE?2[7:0] Input Value read in the Cluster ID Affinity Level 2 field, MPIDR bits[23:16], of the CP15 
MPIDR register. 


These pins are sampled only during reset of the processor. 





CRYPTODISABLE[CN:0] | Input Disables the Cryptographic Extension. 


This pin is sampled only during reset of the processor. 





DBGLIRSTDISABLE Input Disables automatic hardware invalidation of Level 1 RAM after leaving reset. 


This pin is sampled only during reset of the processor. 





L2RSTDISABLE Input Disables automatic hardware invalidation of Level 2 RAM after leaving reset. 


This pin is sampled only during reset of the processor. 
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Table A-3 Configuration signals (continued) 





Signal 


Direction 


Description 








RVBARADDRx{[39:2] 


Input 


Reset Vector Base Address for executing in 64-bit state. 


These pins are sampled only during reset of the processor. 





VINITHI[CN:0] 





Input 





Location of the exception vectors at reset. It sets the initial value of the V bit in the CP15 


SCTLR register: 
© Exception vectors start at address Ox00000080. 
1 Exception vectors start at address OxF FFFQQGO. 


This pin is sampled only during reset of the processor. 
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A.5 Generic Interrupt Controller signals 


The following table shows the Generic Interrupt Controller (GIC) signals. 


Table A-4 GIC signals 





Signal Direction | Description 





nFIQ[CN:0] Input FIQ request. Active-LOW, level sensitive, asynchronous FIQ interrupt request: 


e Activate FIQ interrupt. 
1 Do not activate FIQ interrupt. 


The processor treats the nFIQ input as level-sensitive. The nFIQ input must be asserted until 
the processor acknowledges the interrupt. 





nIRQ[CN:0] Input IRQ request input lines. Active-LOW, level sensitive, asynchronous interrupt request: 
e Activate interrupt. 
1 Do not activate interrupt. 


The processor treats the nIRQ input as level-sensitive. The nIRQ input must be asserted until 
the processor acknowledges the interrupt. 





nSEI[CN:0] Input System Error Interrupt request. Active-LOW, edge sensitive: 
e Activate SEI request. 
1 Do not activate SEI request. 


Asserting the nSEI input causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous External Abort. 

¢ SError interrupt, if taken to AArch64. The ESR_ELx.ISS field is set, see Zable 4-100 ISS 
field contents for the Cortex-A73 processor on page 4-159. 





nVFIQ[CN:0] Input Virtual FIQ request. Active-LOW, level sensitive, asynchronous FIQ interrupt request: 


e Activate FIQ interrupt. 
1 Do not activate FIQ interrupt. 


The processor treats the nVFIQ input as level-sensitive. The nVFIQ input must be asserted 
until the processor acknowledges the interrupt. If the GIC is enabled by tying the 
GICCDISABLE input pin LOW, the nVFIQ input pin must be tied off to HIGH. If the GIC 
is disabled by tying the GICCDISABLE input pin HIGH, the nVFIQ input pin can be driven 
by an external GIC in the SoC. 





nVIRQ[CN:0] Input Virtual IRQ request. Active-LOW, level sensitive, asynchronous interrupt request: 
e Activate interrupt. 
1 Do not activate interrupt. 


The processor treats the nVIRQ input as level-sensitive. The nVIRQ input must be asserted 
until the processor acknowledges the interrupt. If the GIC is enabled by tying the 
GICCDISABLE input pin LOW, the nVIRQ input pin must be tied off to HIGH. If the GIC 
is disabled by tying the GICCDISABLE input pin HIGH, the nVIRQ input pin can be driven 
by an external GIC in the SoC. 
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Table A-4 GIC signals (continued) 





Signal 


Direction 


Description 





nVSEI[CN:0] 


Input 


Virtual System Error Interrupt request. Active-LOW, edge sensitive: 


e Activate virtual SEI request. 


1 Do not activate virtual SEI request. 


Asserting the nVSEI input causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous External Abort. 

¢ SError interrupt, if taken to AArch64. The ESR_EL1.ISS field is set, see Zable 4-100 ISS 
field contents for the Cortex-A73 processor on page 4-159. 





nREI[CN:0] 


Input 


RAM Error Interrupt request. Active-LOW, edge sensitive: 


© Activate REI request. Reports an asynchronous RAM error in the system. 


1 Do not activate REI request. 


Asserting the nREI input causes one of the following to occur: 

e Asynchronous Data Abort, if taken to AArch32. The DFSR.FS field is set to indicate an 
Asynchronous parity error on memory access. 

¢ SError interrupt, if taken to AArch64. The ESR_ELx.ISS field is set, see Zable 4-100 ISS 
field contents for the Cortex-A73 processor on page 4-159. 





nVCPUMNTIRQICN:0] 


Output 


Virtual CPU interface maintenance interrupt PPI output. 





PERIPHBASE[39:18] 


Input 


Specifies the base address for the GIC registers. This value is sampled into the CP15 
Configuration Base Address Register (CBAR) at reset. 





GICCDISABLE 


Input 


Globally disables the GIC CPU interface logic and routes the “External” signals directly to 
the processor: 
@ Enable the GIC CPU interface logic. 


1 Disable the GIC CPU interface logic and route the legacy nIRQ, nFIQ, nVIRQ, and 
nVFIQ signals directly to the processor. Drive this signal HIGH when using a legacy 
interrupt controller such as GIC-400 which does not support GICv3 or GICVv4. 





ICDTVALID 


Input 


AXI4 Stream Protocol signal. Distributor to GIC CPU 
that the master is driving a valid transfer. 


Interface messages. TVALID indicates 





ICDTREADY 


Output 


AXI4 Stream Protocol signal. Distributor to GIC CPU Interface messages. TREADY 
indicates that the slave can accept a transfer in the current cycle. 





ICDTDATA[15:0] 


Input 


AXI4 Stream Protocol signal. Distributor to GIC CPU Interface messages. TDATA is the 
primary payload that is used to provide the data that is passing across the interface. 





ICDTLAST 


Input 


AXI4 Stream Protocol signal. Distributor to GIC CPU 
the boundary of a packet. 


Interface messages. TLAST indicates 





ICDTDEST[1:0] 


Input 





AXI4 Stream Protocol signal. Distributor to GIC CPU 
routing information for the data stream. 


Interface messages. TDEST provides 





ICCTVALID 


Output 


AXI4 Stream Protocol signal. GIC CPU Interface to Distributor messages. TVALID indicates 
that the master is driving a valid transfer. 





ICCTREADY 


Input 


AXI4 Stream Protocol signal. GIC CPU Interface to Distributor messages. TREADY 
indicates that the slave can accept a transfer in the current cycle. 





ICCTDATA[15:0] 








Output 





AXI4 Stream Protocol signal. GIC CPU Interface to Distributor messages. TDATA is the 
primary payload that is used to provide the data that is passing across the interface. 
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Table A-4 GIC signals (continued) 














Signal Direction | Description 

ICCTLAST Output AXI4 Stream Protocol signal. GIC CPU Interface to Distributor messages. TLAST indicates 
the boundary of a packet. 

ICCTID[1:0] Output AXI4 Stream Protocol signal. GIC CPU Interface to Distributor. TID is the data stream 
identifier that indicates different streams of data. 
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A Signal Descriptions 
A.6 Generic Timer signals 


The following table shows the Generic Timer signals. 


Table A-5 Generic Timer signals 









































Signal Direction | Description 
nCNTHPIRQ[CN:0] | Output Hypervisor physical timer event. 
nCNTPNSIRQ[CN:0] | Output Non-secure physical timer event. 
nCNTPSIRQ[CN:0] | Output Secure physical timer event. 
nCNTVIRQ[CN:0] Output Virtual physical timer event. 
CNTCLKEN Input Counter clock enable. 
This clock enable must be asserted one cycle before the CNTVALUEB bus. 
CNTVALUEB[63:0] | Input Global system counter value in binary format. 
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A.7 Power management signals 


The following table shows the non-Retention power management signals. 


Table A-6 Non-Retention power management signals 





Signal Direction | Description 





CLREXMONREQ Input Clearing of the external global exclusive monitor request. When this signal is asserted, it 
acts as a WFE wake-up event to all the cores in the MPCore device. See CLREXMON 
request and acknowledge signaling on page 2-44 for more information. 





CLREXMONACK Output Clearing of the external global exclusive monitor acknowledge. See CLREXMON request 
and acknowledge signaling on page 2-44 for more information. 





EVENTI Input Event input for processor wake-up from WFE state. See Event communication using WFE 
or SEV on page 2-43 for more information. 





EVENTO Output Event output. Active when a SEV instruction is executed. See Event communication using 
WFE or SEV on page 2-43 for more information. 





STANDBYWFI[CN:0] Output Indicates whether a core is in WFI low-power state: 


@ Core not in WFI low-power state. 


1 Core in WFI low-power state. This is the reset condition. 





STANDBYWFE[CN:0] Output Indicates whether a core is in WFE low-power state: 





e Core not in WFE low-power state. 
1 Core in WFE low-power state. 
STANDBYWFIL2 Output Indicates whether the L2 memory system is in WFI low-power state. This signal is active 


when the following conditions are met: 

e All cores are in WFI low-power state, held in reset, or nLZRESET is asserted LOW. 
°. Inan ACE configuration, ACINACTM is asserted HIGH. 

¢ If ACP has been configured, AINACTS is asserted HIGH. 

e L2 memory system is idle. 











L2FLUSHREQ Input L2 hardware flush request. 
L2FLUSHDONE Output L2 hardware flush complete. 
SMPEN[CN:0] Output Indicates whether a core is taking part in coherency. 





DBGNOPWRDWN[CN:0] | Output Core no powerdown request: 


@ Do not request that the core stays powered up. 


1 Request that the core stays powered up. 





DBGPWRUPREQ[CN:0] | Output Core powerup request: 


© Do not request that the core is powered up. 


1 Request that the core is powered up. 
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Table A-6 Non-Retention power management signals (continued) 





Signal Direction | Description 





DBGPWRDUP[CN:0] Input Core powered up: 


(2) Core is powered down. 


1 Core is powered up. 





AWAKEUPM Output Can be used with CCI-500 to provide transfer-level clock wake-up signaling when the 
Cortex-A73 processor performs an AXI access. This signal is HIGH when ARVALID, 
AWVALID, or DWVALID are set, otherwise it is Q. 

















The following table shows the Retention power management signals. 


Table A-7 Retention power management signals 





Signal Direction | Description 





CPUQACTIVE[CN:0] | Output Indicates whether the referenced core is active 





CPUQREQn[CN:0] Input Indicates that the power controller is ready to enter or exit retention for the referenced core 





CPUQDENY[CN:0] Output Indicates that the referenced core denies the power controller retention request 





CPUQACCEPTn[CN:0] | Output Indicates that the referenced core accepts the power controller retention request 
































L2QACTIVE Output Indicates whether the L2 data RAMs are active 
L2QREQn Input Indicates that the power controller is ready to enter or exit retention for the L2 data RAMs 
L2QDENY Output Indicates that the L2 data RAMs deny the power controller retention request 
L2QACCEPTn Output Indicates that the L2 data RAMs accept the power controller retention request 
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A.8 L2 error signals 
The following table shows the L2 error signals. 


Table A-8 L2 error signals 





Signal Direction | Description 





nAXIERRIRQ | Output Error indicator for AXI transactions with a write response error condition. 


See 7.7 External aborts and asynchronous errors on page 7-360 for more information. 








nECCERRIRQ | Output Error indicator for L2 RAM double-bit ECC error. 
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A.9 ACE interface signals 


This section describes the ACE master interface signals: 


e A.9.1 Clock and configuration signals on page Appx-A-579. 

e A.9.2 Write address channel signals on page Appx-A-580. 

e A.9.3 Write data channel signals on page Appx-A-581. 

¢ A.9.4 Write data response channel signals on page Appx-A-581. 

e A.9.5 Read address channel signals on page Appx-A-581. 

¢ A.9.6 Read data channel signals on page Appx-A-582. 

e A.9.7 Coherency address channel signals on page Appx-A-582. 

e A.9.8 Coherency response channel signals on page Appx-A-582. 

e A.9.9 Coherency data channel handshake signals on page Appx-A-583. 
e A.9.10 Read and write acknowledge signals on page Appx-A-583. 


For a complete description of the ACE interface signals, see the ARM® AMBA® AXI and ACE Protocol 
Specification AXI3, AXT4, and AX14-Lite, ACE and ACE-Lite. 
Note 


e This interface exists only if the Cortex-A73 processor is configured to have the ACE interface. 
e All ACE channels must be balanced with respect to CLK and timed relative to ACLKENM. 








A.9.1 Clock and configuration signals 


The following table shows the clock and configuration signals for the ACE interface. 


Table A-9 Clock and configuration signals 














Signal Direction | Description 

ACLKENM Input ACE Master bus clock enable. See 2.3./ Clocks on page 2-33 for more 
information. 

ACINACTM Input Snoop interface is inactive and not participating in coherency: 
(2 Snoop interface is active. 
1 Snoop interface is inactive. 

BROADCASTCACHEMAINT Input Enable broadcasting of cache maintenance operations to downstream caches: 


@ Cache maintenance operations are not broadcast to downstream caches. 


1 Cache maintenance operations are broadcast to downstream caches. 


This pin is sampled only during reset of the Cortex-A73 processor. 


In a bigLITTLE system with Cortex-A73, this pin must be tied to 0 because 
Cortex-A73 does not support this feature. 





BROADCASTCACHEMAINTPOU | Input Enable broadcasting of cache maintenance by Modified Virtual Address (MVA) 
to the Point of Unification (PoU): 


@ Cache maintenance operations by MVA to PoU are not broadcast to other 
clusters. 


1 Cache maintenance operations by MVA to PoU are broadcast to other 
clusters. 


This pin is sampled only during reset of the Cortex-A73 processor. 
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Table A-9 Clock and configuration signals (continued) 





Signal Direction | Description 





BROADCASTINNER Input Enable broadcasting of Inner Shareable transactions: 
© Inner Shareable transactions are not broadcast externally. 


1 Inner Shareable transactions are broadcast externally. 


If BROADCASTINNER is tied HIGH, you must also tie 
BROADCASTOUTER HIGH. 


This pin is sampled only during reset of the Cortex-A73 processor. 





BROADCASTOUTER Input Enable broadcasting of outer shareable transactions: 


@ Outer Shareable transactions are not broadcast externally. 


1 Outer Shareable transactions are broadcast externally. 


This pin is sampled only during reset of the Cortex-A73 processor. 





SYSBARDISABLE Input Disable broadcasting of barriers onto the system bus: 


© Barriers are broadcast onto the system bus. This requires an AMBA 4 ACE. 


1 Barriers are not broadcast onto the system bus. This is compatible with an 
AXI3 interconnect and most AMBA 4 interconnects. 


See 7.4.5 Barriers on page 7-355. 


This pin is sampled only during reset of the Cortex-A73 processor. 




















RDMEMATTRJ7:0] Output Read request memory attributes. 
WRMEMATTRI7:0] Output Write request memory attributes. 
A.9.2 Write address channel signals 


The following table shows the write address channel signals for the ACE interface. 


Table A-10 Write address channel signals 





Signal Direction | Description 





AWADDRM{[39:0] Output Write address. 





AWBARM|{[1:0] Output Write barrier type. 





AWBURSTM[1:0] Output Write burst type. 





AWCACHEM|3:0] | Output Write cache type. 





AWDOMAINM[1:0] | Output Write shareability domain type. 











AWIDM{[7:0] Output Write address ID. 
AWLENM{[7:0] Output Write burst length. 
AWLOCKM Output Write lock type. 





AWPROTM[2:0] Output Write protection type. 


























AWREADYM Input Write address ready. 
AWSIZEM[2:0] Output Write burst size. 
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Table A-10 Write address channel signals (continued) 





Signal Direction | Description 





AWSNOOPM[2:0] | Output Write snoop request type. 





AWVALIDM Output Write address valid. 

















A.9.3 Write data channel signals 


The following table shows the write data channel signals for the ACE interface. 


Table A-11 Write data channel signals 





Signal Direction | Description 





WDATAM[127:0] | Output Write data 











WIDM[7:0] Output Write data ID 
WLASTM Output Write data last transfer indication 
WREADYM Input Write data ready 








WSTRBM[15:0] | Output Write byte-lane strobes 





WVALIDM Output Write data valid 














A.9.4 Write data response channel signals 


The following table shows the write data response channel signals for the ACE master interface. 


Table A-12 Write data response channel signals 





Signal Direction | Description 





BIDM[7:0] Input Write response ID 





BREADYM _| Output Write response ready 





BRESPM{[1:0] | Input Write response 





BVALIDM Input Write response valid 














A.9.5 Read address channel signals 


The following table shows the read address channel signals for the ACE master interface. 


Table A-13 Read address channel signals 





Signal Direction | Description 





ARADDRM[43:0] | Output Read address. 
The top 4 bits communicate only the ACE virtual address for DVM messages. 


The top 4 bits are Read-as-Zero if a DVM message is not being broadcast. 





ARBARM[1:0] Output Read barrier type. 





ARBURSTM[1:0] Output Read burst type. 





ARCACHEMJ3:0] | Output Read cache type. 





ARDOMAINM[1:0] | Output Read shareability domain type. 























ARIDM[7:0] Output Read address ID. 
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Table A-13 Read address channel signals (continued) 











Signal Direction | Description 
ARLENM(7:0] Output Read burst length. 
ARLOCKM Output Read lock type. 





ARPROTM[2:0] Output Read protection type. 





ARREADYM Input Read address ready. 





ARSIZEM[2:0] Output Read burst size. 





ARSNOOPM[3:0] | Output Read snoop request type. 





ARVALIDM Output Read address valid. 

















A.9.6 Read data channel signals 


The following table shows the read data channel signals for the ACE master interface. 


Table A-14 Read data channel signals 


























Signal Direction | Description 

RDATAM[127:0] | Input Read data 

RIDM[7:0] Input Read data ID 

RLASTM Input Read data last transfer indication 
RREADYM Output Read data ready 

RRESPM[3:0] Input Read data response 

RVALIDM Input Read data valid 














A.9.7 Coherency address channel signals 


The following table shows the coherency address channel signals for the ACE master interface. 


Table A-15 Coherency address channel signals 





Signal Direction | Description 





ACADDRM[43:0] | Input Snoop address. 


The top 4 bits communicate only the ACE virtual address for DVM messages. 





ACPROTM[2:0] | Input Snoop protection type. 





ACREADYM Output Master ready to accept snoop address. 




















ACSNOOPM|[3:0] | Input Snoop request type. 
ACVALIDM Input Snoop address valid. 
A.9.8 Coherency response channel signals 


The following table shows the coherency response channel signals for the ACE master interface. 
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Table A-16 Coherency response channel signals 





Signal Direction | Description 





CRREADYM _| Input Slave ready to accept snoop response 





CRVALIDM Output Snoop response valid 





CRRESPM/[4:0] | Output Snoop response 

















A.9.9 Coherency data channel handshake signals 


The following table shows the coherency data channel handshake signals for the ACE master interface. 


Table A-17 Coherency data channel handshake signals 





Signal Direction | Description 





CDDATAM[127:0] | Output Snoop data 




















CDLASTM Output Snoop data last transform 
CDREADYM Input Slave ready to accept snoop data 
CDVALIDM Output Snoop data valid 








A.9.10 Read and write acknowledge signals 


The following table shows the read/write acknowledge signals for the ACE master interface. 


Table A-18 Read and write acknowledge signals 





Signal Direction 


Description 





RACKM | Output 


Read acknowledge 











WACKM | Output 








Write acknowledge 
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A.10 ACP interface signals 


The following ACP interface signals are described: 


e A.10.1 Clock and configuration signals on page Appx-A-584. 
¢ A.10.2 Write address channel signals on page Appx-A-584. 

e A.10.3 Write data channel signals on page Appx-A-585. 

e A.10.4 Write response channel signals on page Appx-A-585. 
e A.10.5 Read address channel signals on page Appx-A-585. 

¢ A.10.6 Read data channel signals on page Appx-A-586. 


Note 





e This interface exists only if the Cortex-A73 processor is configured to have the ACP interface. 
e All ACP channels must be balanced with respect to CLK and timed relative to ACLKENS. 





A.10.1 Clock and configuration signals 


The following table shows the clock and configuration signals for the ACP interface. 


Table A-19 Clock and configuration signals 





Signal Direction 


Description 





ACLKENS | Input 


AXI slave bus clock enable. 





AINACTS | Input 











ACP master is inactive and is not participating in coherency. There must be no outstanding transactions 
when the master asserts this signal, and while it is asserted the master must not send any new transactions: 





(2) ACP Master is active. 
1 ACP Master is inactive. 
Note 


This signal must be asserted before the processor enters the low power L2 WFI state. 











A.10.2 Write address channel signals 


The following table shows the write address channel signals for the ACP interface. 


Table A-20 Write address channel signals 















































Signal Direction | Description 
AWREADYS Output Write address ready 
AWVALIDS Input Write address valid 
AWIDS [4:0] Input Write address ID 
AWADDRSJ39:0] | Input Write address 
AWLENS[7:0] Input Write burst length 
AWSIZES [2:0] Input Write burst size 
AWLOCKS Input Write lock type 
AWBURSTS[1:0] | Input Write burst type 
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Table 4-20 Write address channel signals (continued) 











Signal Direction | Description 
AWCACHESJ3:0] | Input Write cache type 
AWPROTS[2:0] | Input Write protection type 

















A.10.3 Write data channel signals 


The following table shows the write data channel signals for the ACP interface. 


Table A-21 Write data channel signals 
































Signal Direction | Description 

WREADYS Output Write data ready 

WVALIDS Input Write data valid 
WDATAS[127:0] | Input Write data 

WSTRBS[15:0] | Input Write byte-lane strobes 
WLASTS Input Write data last transfer indication 





A.10.4 Write response channel signals 


The following table shows the write response channel signals for the ACP interface. 


Table A-22 Write response channel signals 





Signal Direction | Description 





BREADYS _ | Input Write response ready 





BVALIDS Output Write response valid 





BIDS[4:0] Output Write response ID 





BRESPS[1:0] | Output Write response 














A.10.5 Read address channel signals 


The following table shows the read address channel signals for the ACP interface. 


Table A-23 Read address channel signals 















































Signal Direction | Description 
ARREADYS Output Read address ready 
ARVALIDS Input Read address valid 
ARIDS[4:0] Input Read address ID 
ARADDRS{[39:0] | Input Read address 
ARLENS[7:0] Input Read burst length 
ARSIZES [2:0] Input Read burst size 
ARBURSTS[1:0] | Input Read burst type 
ARLOCKS Input Read lock type 
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Table A\-23 Read address channel signals (continued) 














Signal Direction | Description 
ARCACHESJ3:0] | Input Read cache type 
ARPROTS[2:0] | Input Read protection type 














A.10.6 Read data channel signals 


The following table shows the read data channel signals for the ACP interface. 


Table A-24 Read data channel signals 


























Signal Direction | Description 

RREADYS Input Read data ready 

RVALIDS Output Read data valid 

RIDS[4:0] Output Read data ID 

RDATAS[127:0] | Output Read data 

RRESPS[1:0] Output Read response 

RLASTS Output Read data last transfer indication 














ARM 100048_0002_05_en 


Copyright © 2015, 2016 ARM Limited or its affiliates. All rights 


reserved. 
Non-Confidential 


Appx-A-586 


A Signal Descriptions 
A.11 External debug interface 


























A.11 External debug interface 
The following external debug interface signals are described: 
e A.J11.1 APB interface signals on page Appx-A-587. 
e A.11.2 Miscellaneous debug signals on page Appx-A-587. 
A.11.1 APB interface signals 
The following table shows the APB interface signals. 
Note 
You must balance all APB interface signals with respect to CLK and time them relative to 
PCLKENDBG. 
Table A-25 APB interface signals 
Signal Direction | Description 
nPRESETDBG Input APB reset, active-LOW: 
(2) Apply reset to APB interface. 
1 Do not apply reset to APB interface. 
PADDRDBG[21:2] | Input APB address bus. 
PADDRDBG31 Input APB address bus bit[31]: 
(2) Not an external debugger access. 
1 External debugger access. 
PCLKENDBG Input APB clock enable. 
PENABLEDBG Input Indicates the second and subsequent cycles of an APB transfer. 





PRDATADBG[31:0] | Output APB read data. 





PREADYDBG Output APB slave ready. 


An APB slave can deassert PREADYDBG to extend a transfer by inserting wait states. 





























PSELDBG Input Debug bus access. 
PSLVERRDBG Output APB slave transfer error: 
e No transfer error. 
1 Transfer error. 
PWDATADBGJ31:0] | Input APB write data. 
PWRITEDBG Input APB read or write signal: 
e Reads from APB. 
1 Writes to APB. 
A.11.2 Miscellaneous debug signals 


The following table shows the miscellaneous Debug signals. 
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A Signal Descriptions 
A.11 External debug interface 


Table A-26 Miscellaneous Debug signals 





Signal Direction | Description 





DBGROMADDR{39:12] | Input Debug ROM base address. 
Specifies bits[39:12] of the ROM table physical address. 
If the address cannot be determined, tie this signal LOW. 


This pin is sampled only during reset of the processor. 





DBGROMADDRV Input Debug ROM base address valid. 
If the debug ROM address cannot be determined, tie this signal LOW. 


This pin is sampled only during reset of the processor. 

















DBGACK[CN:0] Output Debug acknowledge: 
e External debug request not acknowledged. 
1 External debug request acknowledged. 
nCOMMIRQ[CN:0] Output Communications channel receive or transmit interrupt request: 
(2) Request interrupt. 
1 No interrupt request. 
COMMRX[CN:0] Output Communications channel receive. Receive portion of Data Transfer Register full flag: 
(2) Empty. 
1 Full. 
COMMTX[CN:0] Output Communication transmit channel. Transmit portion of Data Transfer Register empty flag: 
e Full. 
1 Empty. 
EDBGRQ[CN:0] Input External debug request: 
e No external debug request. 
1 External debug request. 


The processor treats the EDBGRQ input as level-sensitive. The EDBGRQ input must be 
asserted until the processor asserts DBGACK. 





























DBGEN[CN:0] Input Invasive debug enable: 
e Not enabled. 
1 Enabled. 

NIDEN[CN:0] Input Non-invasive debug enable: 
e Not enabled. 
1 Enabled. 

SPIDEN[CN:0] Input Secure privileged invasive debug enable: 
(2) Not enabled. 
1 Enabled. 
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A Signal Descriptions 


A.11 External debug interface 


Table A-26 Miscellaneous Debug signals (continued) 























Signal Direction | Description 
SPNIDEN[CN:0] Input Secure privileged non-invasive debug enable: 
e Not enabled. 
1 Enabled. 
DBGRSTREQ[CN:0] Output Warm reset request. 
DBGNOPWRDWN[CN:0] | Output Core no powerdown request: 
e Do not request that the core stays powered up. 
1 Request that the core stays powered up. 
DBGPWRUPREQ[CN:0] | Output Core powerup request: 
e Do not request that the core is powered up. 
1 Request that the core is powered up. 
DBGPWRDUP[CN:0] Input Core powered up: 
(2) Core is powered down. 
1 Core is powered up. 
DBGLIRSTDISABLE Input Disable L1 data cache automatic invalidate on reset functionality: 











(2) Enable automatic invalidation of L1 data cache on reset. 


1 Disable automatic invalidation of L1 data cache on reset. 


This pin is sampled only during reset of the processor. 
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A.12 ATB interface s 


ignals 


The following table shows the ATB interface signals. 





Note 


A Signal Descriptions 


A.12 ATB interface signals 


e You must balance all ATB interface signals with respect to CLK and time them relative to 


ATCLKEN. 





Table A-27 ATB interface signals 
































Signal Direction | Description 
ATCLKEN Input ATB clock enable 
ATREADYMx Input ATB device ready 
AFVALIDMx Input FIFO flush request 
ATDATAMx{[31:0] | Output Data 
ATVALIDMx Output Data valid 
ATBYTESMx[1:0] | Output Data size 
AFREADYMx Output FIFO flush finished 
ATIDMx[6:0] Output Trace source ID 
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A.13 Miscellaneous ETM trace unit signals 


A Signal Descriptions 
A.13 Miscellaneous ETM trace unit signals 


The following table shows the miscellaneous ETM trace unit signals. 


Table A-28 Miscellaneous ETM trace unit signals 





Signal 


Direction 


Description 





SYNCREQx 


Input 


Synchronization request from trace sink 








TSVALUEB[63:0] 





Input 








Timestamp in binary encoding 
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A.14 CTI interface signals 


The following table shows the CTI interface signals. 


A Signal Descriptions 
A.14 CTI interface signals 


Table A-29 CTI interface signals 



































Signal Direction | Description 

CTICHIN[3:0] Input Channel In 

CTICHOUTACK[3:0] | Input Channel Out acknowledge 
CTICHOUT{3:0] Output Channel Out 

CTICHINACKYJ3:0] Output Channel In acknowledge 
CISBYPASS Input Channel interface sync bypass 
CIHSBYPASS[3:0] Input Channel interface handshake bypass 
CTIRQ[CN:0] Output CTI interrupt (active-HIGH) 
CTIRQACK[CN:0] | Input CTI interrupt acknowledge 
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A.15 PMU interface signals 


The following table shows the PMU interface signals. 


A Signal Descriptions 


A.15 PMU interface signals 


Table A-30 PMU interface signals 

















Signal Direction | Description 
PMUEVENTX[37:0] | Output PMU event bus 
nPMUIRQ[CN:0] Output PMU interrupt request 
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A Signal Descriptions 
A.16 DFT and MBIST interface signals 


A.16 DFT and MBIST interface signals 
The following interfaces are described: 


e A.16.1 DFT interface on page Appx-A-594. 
e A.16.2 MBIST interface on page Appx-A-594. 


A.16.1 DFT interface 
The following table shows the DFT interface signals. 


Table A-31 DFT interface signals 




















Signal Direction | Description 

DFTCGEN Input Scan shift enable, forces on the clock grids during scan shift. 

DFTRAMHOLD Input Disable the RAM chip select during scan testing. 

DFTRSTDISABLE[1:0] | Input Disable internal synchronized reset during scan shift. 

DFTMCPHOLD Input Disable multicycle paths on RAM interfaces. 

DFTCLKBYPASS Input Bypass internal stretched clock for test purposes if LAHALFDATARAMCLK configuration 
is used. 

















A.16.2 MBIST interface 
The following table describes the signals for the MBIST interface. 


Table A-32 MBIST interface signals 











Signal Direction | Description 
nMBISTRESET _ | Input MBIST reset. 
MBISTREQx{3:0] | Input MBIST L1 test request. 














Note 
Apart from nMBISTRESET and MBISTREQ«x, all MBIST signals are internal to artemis_nocpu.v 
module and connected to artemis_topmbmux.v module. The MBIST controller is expected to be directly 
connected to artemis_topmbmux.v module. 
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Appendix B 
Revisions 


This appendix describes the technical changes between released issues of this document. 


It contains the following sections: 
e B.1 Revisions on page Appx-B-596. 





ARM 100048_0002_05 en Copyright © 2015, 2016 ARM Limited or its affiliates. All rights Appx-B-595 
reserved. 
Non-Confidential 


B Revisions 
B.1 Revisions 









































B.1 Revisions 
This section describes the technical changes between released issues of this document. 
Table B-1 Issue 01 
Change Location | Affects 
First release | - 7 
Table B-2 Differences between Issue 01 and Issue 02 
Change Location Affects 
Added note about integer clock ratio. CORECLKEN[CN: 0] clock enable signal on page 2-36 All Versions 
Updated description of CLIDR_EL1 LoUIS bits. 4.3.30 Cache Level ID Register on page 4-112 All Versions 
Updated CCSIDR encodings. 4.5.21 Cache Size ID Register on page 4-238 All Versions 
Added note about aliases in the L1 data memory 6.5 L1 data memory system on page 6-333 All Versions 
subsystems. 
Updated ACE transactions. 6.5.6 ACE transactions on page 6-335 All Versions 
Updated some reset values in the debug registers. ¢ 10.3 AArch64 debug register summary on page 10-381 | All Versions 








¢ 10.3 AArch64 debug register summary on page 10-381 











Table B-3 Differences between Issue 02 and Issue 03 


























Change Location Affects 

Updated signals for exit from L2 WFI standby state. | L2 Wait for Interrupt on page 2-44 All Versions 
Added note about cache disable. 4.3.71 L2 Control Register on page 4-168 All Versions 
Updated description of Attr fields. 4.3.74 Physical Address Register, EL1 on page 4-173 | All Versions 
Added note about access from an external debugger. | 6.7 Direct access to internal memory on page 6-337 | All Versions 
Updated read issuing capability. 7.4.1 Memory interface attributes on page 7-353 All Versions 
Added note. 7.5 Additional memory attributes on page 7-356 All Versions 














Table B-4 Differences between Issue 03 and Issue 04 


















































Change Location Affects 
Updated the Input synchronization list. 2.3.2 Input synchronization on page 2-36 All Versions 
Updated the Individual core shutdown mode section. | Individual core shutdown mode on page 2-49 All Versions 
Updated the Cluster shutdown mode without system | Cluster shutdown mode without system driven L2 flush All Versions 
driven L2 flush section. on page 2-50 
Updated the LoUIS field of the CLIDR_EL1 register | 4.3.30 Cache Level ID Register on page 4-112 All Versions 
Updated the Flush index increment field of the 4.3.71 L2 Control Register on page 4-168 All Versions 
L2CTLR_ELI register. 
Updated the Cache behavior description 6.2 Cache behavior on page 6-329 All Versions 
Updated bit-field of Data Register 1. 6.7.1 Data cache tag and data encoding on page 6-338 All Versions 
Updated note. 7.3.1 Snoop and maintenance requests on page 7-352 All Versions 
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Table B-5 Differences between Issue 04 and 05 





























Change Location Affects 

Updated Events table 11.9 Events on page 11-457 All Versions 

Changed number of CLK cycles | Event communication using WFE or SEV on page 2-43 | All Versions 
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